Privacy policy.

On the website: whatever you choose to send us through the contact form, the site chat, or a booking, such as your name, your email address, and your message. Our hosting provider also keeps standard server request logs.

In the app: your account email address, your display name, the messages you send, and the files and photos you attach to them.

The app asks for camera and photo library access only when you choose to attach a photo. Attachments you pick are uploaded to your workspace. Nothing is read from your library beyond what you pick.

When you choose to dictate, the app or website asks for microphone access. When you choose to transcribe, the recording is sent to OpenAI after you have agreed to share it. You can add the text to a draft, and the app also lets you choose to transcribe and send it. Exapta deletes its temporary recording afterward and does not keep it as an attachment.

When you choose to talk live, your voice is sent to OpenAI as you speak and Exapta keeps a text transcript of the conversation in your workspace. Exapta does not keep the audio.

When Exa's browser asks you for a sign-in code and you type it to Exa, the code goes straight to the browser: Exa's AI models never see it, and no copy is kept. A code you say aloud while the browser is asking for one is replaced with a note in the conversation's transcript wherever Exapta recognizes it, and the voice models answering you hear it as you say it. Exapta then asks OpenAI to delete it from that live conversation.

If you turn on Exa on your computer, Exa reads and acts on your texts, email, contacts, calendar, apps and files there only as far as you allow on that computer, and what it reads goes to the AI companies whose models do that work: the one that runs Exa for that conversation, and OpenAI when an OpenAI model does Exa's clicking in your browser. Texts with people in your CRM are kept with those contacts.

When you ask Exa to work in your own Chrome, the Exapta for Chrome section below says what it reads.

Video calls collect more, and the Calls section below says what.

To run the service: sign you in, deliver your messages, store your attachments, turn recordings you choose to dictate into text, run Exa and the other AI features the AI providers section describes, and answer you when you write to us. That is the whole list.

We do not sell your data. The app shows no ads, contains no third-party analytics, and does not track you across other apps or websites.

You sign in with a code sent to your email address. We do not store passwords. You can also sign in with your Google account, and Google then gives Exapta your name, email address and profile picture.

You can connect your own Google account to your workspace. Exapta asks Google for each permission only when you turn on the feature that needs it. When you connect your calendar, Exapta also asks to change events on calendars you own, if your access in the workspace allows it. Google's screen names each permission before you agree.

Email. With permission to read your email, Exapta shows your Gmail in the workspace Inbox, and Exa reads it when you ask in your own conversation with Exa. With permission to send, Exapta sends email from your address when you press Send, when you tell Exa to send it, and when you approve a campaign or a follow-up that sends from it.

With permission to organize your email, you can archive, star and mark mail read or unread in the workspace Inbox, and opening an email there marks it read. You can also write, save, discard and send drafts there. When you ask, Exa archives your mail, adds or removes its labels, making a label you name if it does not exist, or moves it to the trash. Exa writes draft replies and new emails into your Gmail drafts for you to read, change and send. After a call you hosted is filed on a contact, Exapta writes the follow-up email into your Gmail drafts and later checks your sent mail for it. This permission also lets Exapta send email in the ways above.

Calendar. With permission to read your calendar, the workspace calendar shows your events, to you only, beside your team's tasks, and the booking page leaves out the times you are busy. Exapta keeps a copy of your events from 30 days back to 90 days ahead. Exa reads your calendar when you ask it. In a conversation other people read, they see its answer.

With permission to change events on calendars you own, Exapta puts the dated tasks on your to-do list on your own Google calendar. It asks for this permission only when your access in the workspace allows it. When a task changes, Exapta changes its event. When you finish or delete the task, Exapta removes the event. You can turn this off in Settings, under Your profile. With the same permission, Exa adds, changes or removes events on your calendar when you ask it, and invites the guests you name.

Contacts. With permission to read your contacts, you can bring them into the workspace's contact list, if your workspace lets you add contacts. Exa can also read your Google contacts when you ask it. In a conversation other people read, they see its answer.

Mail from an account you connected yourself is shown only to you, and Exa reads it only in your own conversation with Exa. What Exa writes in that conversation, including what it quotes from your mail, stays there like your other messages. One exception: when you choose your own Gmail as a sending address in the workspace, the email you send through it to the workspace's contacts, campaigns included, and the replies to that email are kept with those contacts, where your team and its Exa can read them. If your workspace's administrator connected your work domain, your work mailbox follows the workspace's rules instead.

The keys Google gives Exapta for your account are kept encrypted. Exa's AI providers receive the part of your Google data a task needs, to do that task, under the terms that section names. Exapta does not use your Google data for advertising and does not sell it. People at Exapta do not read it unless you ask us to, for security, or when the law requires it.

Exapta does not use your Google data to develop, improve or train generalized AI or machine learning models. Training is turned off on every Claude subscription account and ChatGPT account Exapta holds that can receive your Google data, and on the Cartesia account Exapta uses. Under the terms the AI providers section names, Anthropic's API and the paid Gemini API do not train on it either. Exapta's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To disconnect, open Connections in your workspace and press Disconnect. Exapta deletes the keys and the calendar events it read, and revokes its access at Google. It keeps the account's address and Google's id for it. You can also remove Exapta on Google's account permissions page. Contacts you imported, and the mail kept with the workspace's contacts, stay in the workspace. Deleting your Exapta account does not remove them either.

Thirteen providers process data on our behalf to provide the service: Supabase for the database, authentication, and storage; Cloudflare R2 for file storage, call recordings included; Vercel for hosting; Amazon Web Services for the machines Exapta runs, which, among other work, join calls that keep a transcript, build call recordings, run Talk live, and run the browser Exa uses for you, which loads the web pages Exa opens for you, including pages you sign into; Anthropic for Exa, the assistant in a workspace, and for reading what a business adds to its Knowledge in Exapta to check it for conflicts; Resend for the email we send you and the internal alert that tells our team you wrote; Google for sign-in with Google and the calendar invite when you book a call, and for transcribing the recordings and reading the scanned documents a business adds to its Knowledge; Zoom for the meeting itself; LiveKit for the video and audio of calls in a workspace; OpenAI for transcribing recordings you choose to dictate, for live voice conversations you choose to start, for call transcripts and notes, and for Exa's clicking in Exa's browser and in your own Chrome or Safari when an OpenAI model does it; xAI for answering the messages you type into the site chat, and for tidying the words of a dictation when you choose Refine; Cartesia for speaking Exa's replies aloud in Talk live and in Exa's voice mode; Expo for delivering the mobile app's notifications, which show the workspace's name, the sender's name and a preview of the message. The AI providers section below says what each AI provider receives, when, and what for.

OpenAI processes dictated recordings and live voice conversations under its API data policies. Its handling and retention are separate from Exapta deleting its temporary recording. Read OpenAI's data controls for the provider's current terms.

Exa, the assistant in a workspace, is an AI. Exa and some other features of Exapta run on AI models from five companies: Anthropic, OpenAI, Google, xAI and Cartesia. Each one receives data only for the features named here. This section says what each receives, when, and what for.

In the mobile app, from version 1.4.0, nothing you write to Exa, and nothing you dictate or say to Exa out loud, goes to any of them until you allow AI in the app's “AI and your data” screen. A call's transcript starts only after each person in the call agrees to that call's transcript. When someone else asks Exa about a conversation you are in, Exa reads it, your messages included.

Anthropic makes the Claude models that write Exa's replies and do the work you ask Exa to do. When you write to Exa, Anthropic receives your message and what Exa reads to answer it: the conversation, the records and files Exa opens, and the pictures you attach. It also receives the web pages Exa browses for you and their screenshots, including pages you sign into. When another member of your workspace asks Exa something, Exa can read the conversations that member can read, your messages included. In Talk live and in Exa's voice mode, Exa runs on Claude unless your workspace picks another model for it. Anthropic then receives what you say to Exa and the voice conversation's saved context: its earlier lines, Exa's notes, what Exa's workers were asked and where they stand, and short excerpts of their reports. Claude models also read what a business adds to its Knowledge and answer questions from it, draft email in a business's own voice from its sent mail, and sum up a business's website analytics. When you start on exapta.ai, it asks three questions about your business, and a Claude model reads your answers to sort the kind of business, find its name and write one sentence about it. When a conversation gets its first message, a Claude model reads up to 500 characters of it to name the conversation, and, later, up to 1,500 characters of its latest lines to name it again. It also reads the name and role of any of the business's contacts the conversation mentions or was started from. When its sender has AI off in the mobile app (version 1.4.0 and later), the name is the message's first words instead, and no model reads it.

Exapta reaches these models through Anthropic's API, and Anthropic's Commercial Terms say Anthropic may not train models on what it receives there. Some work runs on Claude subscription accounts that Exapta holds instead: Exa's work in Talk live and in Exa's voice mode, reading Knowledge, the Site editor, cleaning the transcripts of videos Exa is asked to transcribe, the video studio, jobs in 1 Source Medicine's own workspace, and the coding seats. Those accounts are under Anthropic's Consumer Terms, which let Anthropic train its models on what they send unless training is turned off in the account's settings.

OpenAI's models turn speech into text and talk with you in Talk live. OpenAI receives the recording when you choose to transcribe a dictation, your voice while you talk live or use Exa's voice mode, each person's speech in a call while its transcript is on, and the audio of videos Exa is asked to transcribe. With a call's speech, OpenAI also receives the names of the people in the call and in its conversation, and the workspace's name, its words to know and the names of its contacts and companies, so the words are written down right. A member who has AI off in the mobile app (version 1.4.0 and later) is left out of the members' names Exapta adds, unless they joined the call and agreed to its transcript. The name the call shows for each person in it can still go. Its models also put English under the lines of a call spoken in another language, write the notes Exa makes from a call's transcript, and sum up a Talk live conversation. After a call with no transcript, OpenAI receives how long it ran, who was on it and who shared a screen, and the messages written around it, to write Exa's note. When someone on the call, or someone who wrote one of those messages, has AI off in the mobile app (version 1.4.0 and later), OpenAI receives none of this, and the note holds only those facts. When neither Cartesia nor xAI can speak a reply in Talk live or Exa's voice mode, OpenAI speaks it and receives its text. When an OpenAI model does Exa's clicking, in Exa's browser or in your own Chrome or Safari, whether it is the default model or one you or a workspace owner picks, OpenAI receives what Claude would receive for that work: the task Exa gives the browser, the details it needs for that task, and the pages Exa reads and acts on with their pictures, including pages you are signed into. Each of those requests asks OpenAI not to store its answer for later retrieval. Exapta sends this through OpenAI's API, and OpenAI's API data controls say data sent to its API is not used to train its models unless the business that sends it opts in.

Some work runs on ChatGPT accounts that Exapta holds, through OpenAI's Codex: the check on email and campaign messages before they are sent, pictures for the video studio, summaries of a conversation, Exa in Talk live and in Exa's voice mode when a workspace picks an OpenAI model for it, and the coding seats. Whether OpenAI may train its models on what those accounts send depends on each account's plan. OpenAI's Codex pricing page lists no training on business data by default for its Business and Enterprise plans, and not for its Plus and Pro plans.

Google's Gemini models transcribe the recordings and read the scanned documents a business adds to its Knowledge. In Exa's voice mode, a Gemini model answers what you say when you pick it in Voice settings. It then receives what you said, the voice conversation's saved context and your voice settings. In the video studio, which only some workspaces have, Google's Veo and Gemini models make and check video from what the person asking for it provides, and the coding seats use Gemini to find moments in recordings. When you ask Exa to find a moment in a call's recording, Gemini reads the call's transcript and what you asked for. Exapta uses the paid Gemini API, and Google's Gemini API terms say Google does not use prompts or responses on paid services to improve its products.

xAI's Grok models tidy the words of a dictation when you choose Refine. They receive the text of the dictation, never the recording. They answer the chat on exapta.ai and the chat a business puts on its own website, with the visitor's messages and what the business chose to show visitors. In Talk live they read what is said and answer your questions about Exa's work. In Exa's voice mode they answer what you say unless you pick another model in Voice settings, and receive what you said, the voice conversation's saved context and your voice settings. When Cartesia cannot speak a reply in Talk live or the voice mode, xAI speaks it and receives its text. When no Claude account is free, a Grok model can take Exa's turn in Talk live and the voice mode. For the coding seats, a Grok model reads each request to choose the model that takes it, and takes a turn when no Claude account is free. Exa for people with ground up access answers on xAI's Grok models, and Exa's browser may run on them too. xAI then receives what Claude would receive for that work: the messages sent to Exa, the conversation Exa needs to answer, the files shared with Exa, and, for the browser, the pages Exa browses with their screenshots, including pages you sign into. A workspace owner can choose another model the page names for these uses. Exapta sends this through xAI's API, and xAI's API security page says it never trains on API inputs or outputs without the customer's explicit permission.

Cartesia's voices read replies aloud in Exa's voice mode, which is off until you turn it on. In Talk live they can read Exa's replies aloud even when the voice mode is off. Cartesia receives the text it speaks, never your voice. Cartesia's terms of service let it use what it receives to improve its models unless the customer has asked it not to.

Through their APIs, Anthropic, OpenAI, Google and xAI each receive the data only to perform the service for Exapta, under terms that protect it at least as well as this policy does. The subscription accounts and Cartesia work under the terms named above.

To withdraw your permission in the mobile app (version 1.4.0 and later), open Settings and turn off “AI and your data”. The app then holds Exa, dictation, Talk live and conversations where Exa answers every message until you allow AI again, as it does after Not now. A job's Run now, Turn on and Resume wait too. Turning it off stops what the app would send to these companies from then on, except a call's transcript you agree to on its own sheet. Work you started before goes on, such as an errand the browser is running for you, a quote round, a document you added to Knowledge, or a profile whose videos you asked to have transcribed on a schedule. The app also tells Exapta your answer, and when it asks Exa for something, Exapta acts on the newest answer you gave, even one you gave on another phone. The website, the desktop app and versions of the mobile app before 1.4.0 have no such screen, so what you ask there is taken as allowed: AI features run when you use them, and you can stop by not using Exa, dictation, Talk live and Exa's voice mode. Some work Exapta does on its own reads the answer it holds for you, wherever you use Exapta. While AI is off for you, a new conversation whose first message is yours is named from its first words, and the note after a call with no transcript holds only the facts when you were on the call or wrote one of the messages around it. The summaries of your Talk live sessions stop, and the members' names sent with a call's speech leave you out unless you joined the call. A run of your jobs that nobody pressed is skipped, including one Exa starts inside a job's own run. A run you start yourself on the website or the desktop app, with Run now or by asking Exa, runs. Claude can still read what you write in a shared conversation when another member asks Exa. To have your account deleted, email joe@exapta.ai from the address on the account. Exapta deletes your login and keeps every record about you.

People in an Exapta workspace can hold video calls in their conversations, from the website, the desktop app or the mobile app. They can invite people from outside the workspace by a link: a guest to a call, a customer to a conversation with the team, or the attendees of a class. A guest joins from a web browser and needs no account.

Every guest sees and hears the call, and sees a screen when someone shares one. A guest invited to a call only, and a class attendee, never see the workspace's conversation, the call's transcript, its recording or its notes.

A member can also invite a guest as a customer, by email address. A customer has a conversation with the team. By default, adding a customer to a call moves the call to a conversation of only the members and customers in the call. There the customer reads what is written to everyone after they joined, and writes back. They never see messages written only to the team, questions to Exa or Exa's answers to the team, replies in sub-threads, notes, recordings, or anything written before they joined. Exa writes to a customer only when a member of the workspace asks it to. A file opens for a customer only from a message they can see. The customer also reads the transcript lines spoken while they were in a call there, and no others.

To open the conversation on a browser, the customer types a code we email to them. The guest page remembers that browser with a random mark. The mark stays in the browser's local storage until it is cleared, and in a cookie named exapta_guest_mark for 400 days from its last use. Exapta keeps only a hash of the mark. When a message from someone else has waited unread for 10 minutes, we email the customer, at most once an hour per conversation, and never with the message's text. Each of those emails has a link to stop them. A notice names the member who wrote. An invitation to a call, a conversation or a class names the member who sent it. A reply to either goes to that member's email address. A member can remove the customer from the conversation, and then the customer reads nothing more there. A customer's message never starts Exa. When a member asks Exa something, Exa can read the conversation, the customer's messages included, with Anthropic's models.

A workspace can also share a class link for a course. An attendee gives a name and an email address, or opens a personal invitation, and types a code we email to that address, once on each browser, remembered the same way. For a student whose guardian's address is on file, the invitation and the code go to the guardian. Attendees wait until a member of the workspace lets them in, though people on the class's list can go straight in. Other attendees see each attendee's first name and last initial, or the full name or no name when the host chooses, and never an email address. Exapta keeps the times each attendee was connected. A class marked as possibly including minors cannot be recorded or transcribed.

A call uses your camera and microphone while you have them on, and your name. For a guest, it also keeps the name and the email address the person who invited them entered, with the link, so the invite can be sent. A class attendee gives their own, or the class's list holds it. For a customer, the workspace also keeps what they write and when they last read the conversation. Exapta keeps when each person connected to the call and left it, as LiveKit reports it, and each person's agreement to a transcript or a recording. To limit repeated tries, Exapta counts a guest's requests under a keyed hash of their IP address, never the address itself.

The video and audio travel through LiveKit, the company that runs the call's media. Exapta does not keep the video or audio of a call unless the call is recorded.

A person can blur the background behind them in a call, and see their own camera as in a mirror. These video effects run on the person's own device. The program and the model that blur the background load from exapta.ai, and no camera frame goes to an effects provider. The video, with the effect, still reaches the people in the call and any recording, under the call's own rules for agreeing to a recording.

The host decides whether a call has a transcript or a recording. Neither starts until everyone in the call agrees. When the host turns one on, each person is asked. A person who does not agree does not join, or leaves the call.

When the transcript is on, each person's speech is sent to OpenAI to be written down. The workspace keeps the transcript. Each line names who said it, and a guest's lines are marked as a guest's. Exa, the assistant in the workspace, can write notes from the transcript in the conversation, also with OpenAI. When a member of the workspace asks Exa about a call, Exa reads the parts of the transcript it needs, with Anthropic's models.

When recording is on, LiveKit records the call to a file in the workspace's storage at Cloudflare R2. A computer Exapta runs builds the finished recording from that file and keeps a copy. A workspace can turn on an accuracy test, which also keeps each person's microphone as a file of its own, to check how well the transcript is written.

Exapta files each call with a guest on that guest's record in the workspace's contacts, whether or not anything was captured. For a customer or a class attendee, Exapta finds the record by email address and makes one when there is none. For a guest invited to a call only, a member of the workspace picks or confirms the record first. The entry says when the call was, how long it ran and how long the guest was connected, who was there, and what was captured. It names at most five other guests, and a class attendee's entry names no other attendee. It holds no words from the call and no email address. Anyone in the workspace who may read the record can see the entry. The transcript, the recording and the note behind it open only for the people the conversation allows. For calls in 1 Source Medicine's own workspace, the entry goes to the person's record in the 1 Source Medicine student portal instead, with their name and email address. There a guest invited to a call only is filed by the email address on their invitation, with no pick by a member needed. When a member did pick a record for them, the address on that record is used. For a class linked to a lecture session the portal knows, the entry is attendance, with the times the person was connected. Otherwise it is an ordinary call entry, without those times.

The workspace keeps the transcript, the notes and the recording in the conversation, for its members. Nothing deletes them on a schedule. The same holds for a customer's conversation, a class's list, connection times and the entries on contact records. The call's host, or an owner or admin of the workspace, can delete a call's transcript and recording in one step. That removes every copy Exapta keeps, the one on Exapta's computer and the note written after the call included. An entry on a contact record keeps its facts and says the recording and transcript were deleted. For an entry in the student portal, Exapta asks the portal to remove it. What people wrote in the conversation stays, words they quoted from the transcript included.

Exapta keeps a guest's record and their conversations, and never deletes them on its own. A guest with a question about them can ask the person who invited them, or email joe@exapta.ai.

The Exapta extension for Chrome lets Exa work in your own Chrome when you ask it to, with your sign-ins. When the Exapta app's browser connection works on the same computer, the extension connects Chrome to the app and to nothing else, except that exapta.ai can ask it whether it is installed and connected. It then works only while the app is open with Use your browsers turned on.

With no Exapta app on that computer, or when the app's browser connection cannot start, the extension connects to exapta.ai over HTTPS. It opens an exapta.ai page once to link that Chrome to the Exapta account signed in there. To link it, Exapta keeps the browser's name and version, the kind of computer, the extension's version, a random id for that copy of the extension, the public half of a key the extension makes in that browser, the account and workspace it is linked to, the sign-in session that linked it, and when the link began and ended. From then on the extension takes Exa's steps from Exapta and sends back what they did, with pictures of the tab going to Exapta's file storage. Each step is signed by Exapta, and the extension checks that before it does anything. An exapta.ai page open in that Chrome can also ask it to stop Exa, and tell it which workspace you are in.

On that computer the extension keeps the workspaces it is linked to, its switch, and the ids of the steps it took in the last day, so it does not repeat a step, though a read that was cut off may run again. It also keeps each reply, which can include page text, until Exapta has it.

Exa stops working in that Chrome when you turn off Let Exa work in this Chrome. Forgetting that Chrome on the Computer page ends its link to that workspace, until you open Exapta in that workspace in that Chrome again. Its other workspaces stay linked. Signing out of Exapta in that Chrome ends the links that sign-in made.

For each request, the Exapta app, or without it the extension, reads and acts in the tabs Exa uses: the tabs Exa opened, and a tab of yours only when you ask Exa to use it. To find a tab, it reads the titles and addresses of your open tabs. It also notes which tab and window you move to, so Exa's tab can step out of your way. What Exa reads, the page's text, the tab's title and address, and pictures of the tab, goes to Exapta and to the AI companies whose models do that work: the one that runs Exa for that conversation, and OpenAI when an OpenAI model does Exa's clicking. Before anything leaves your computer, the app or the extension hides what is in password, sign-in code and card fields, and card numbers in the page's text, and covers those fields in pictures. When it cannot cover them, it sends no picture. A code that a page shows as ordinary text goes with the rest of the page.

With the Exapta app, when you ask Exa to put a file from your computer into a page, Chrome gives the file to that website as if you had picked it. The file goes to the website, not to Exapta.

The extension never receives passwords or codes saved in the Exapta app. You type passwords, codes and passkeys, and complete robot checks, in your own Chrome window. Activity in Exapta lists what Exa asks the browser to do. You can stop Exa with Stop in the extension, Stop in Exapta, or Cancel on the bar Chrome shows while Exa works, and with the app, Stop everything in the Exapta menu bar.

Exapta does not sell what the extension gives it, does not use it for advertising, and does not use it to decide creditworthiness. People at Exapta do not read it unless you ask us to, for security, or when the law requires it. Exapta's use of information received from the extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Some businesses that use Exapta put a chat on their own website. The chat on exapta.ai is the same chat, run for Exapta itself, and what this section says holds for it too: there, Exapta is the business, and the messages are kept in Exapta's own workspace. Messages typed there are answered by xAI on that business's behalf, or by the business's own AI when it has connected one. They are kept in that business's workspace, where its team can read them. Answers may draw on documents the business has chosen to make available to visitors. The assistant that team uses inside Exapta runs on Anthropic and can read the first 140 characters of each message. Resend emails the business when a question goes unanswered, and when a visitor leaves an email address or phone number, with the question and those details. When the business's own site gives the chat a reference to how the visitor reached the site, the chat hands that reference back to the business with the details the visitor leaves. Exapta does not store it.

The chat remembers a visitor with a random id in a cookie named exapta_visitor, kept for one year, and a copy in the browser's local storage. It stores a keyed hash of the visitor's IP address, never the address itself. With each message, it keeps the path and the title of the page on the business's website the message was sent from, and nothing else of that page: not the query or the fragment of its address, and none of its content. Of that path and title it keeps only plain words and short numbers: anything that looks like an address, a code or an id is left out. Exapta keeps the conversations and never deletes them on its own. With a question about one, contact the business or email joe@exapta.ai.

Exapta keeps the records it holds about a person. It never deletes them on its own, and deleting an account does not remove them. A person with the authority in a workspace can delete a record there on purpose, as the Calls section says for a call's transcript and recording. To have your account deleted, email joe@exapta.ai from the address on the account. Exapta deletes your login, and your records stay.

Exapta is a tool for businesses. It is not directed to children.

If this policy changes, the new version is posted here with a new effective date.

Questions about this policy go to joe@exapta.ai. A person reads it.