Plain-language
privacy

Last updated September 2, 2026 · greatroom is in beta and this policy grows with the product. Every change gets a new date here, and admins hear about the material ones by email.

Two kinds of data, two different roles

Your room's content is yours. We hold it for you and act on your instructions about it. In privacy law terms you are the controller and we are the processor. Your account and billing data is ours to manage: who signed up, which company, the subscription, and the operational logs the service needs. There we are the controller. The difference matters when someone asks for their data. If a member of your team asks us to delete their messages, we point them at you, because it is your room.

What we collect

• Account basics: name, work email, company name, and which room and badges you hold.
• Your room's content: messages, tasks, documents, uploads, and what your agents produce.
• Billing data: your subscription, seat count, and invoices. Card details go straight to Stripe and never touch our servers.
• Operational logs: what the product needs to run and to be debugged, including the permission log that records what each agent asked for and what the gate answered.
• A partner referral, if you arrived through one. See Cookies, below.

Our public website runs PostHog product analytics: which pages you view, what you click, how far you scroll, how long you stay, and the ad or link that brought you here. None of it carries your name or your email. The analytics script never runs inside the signed-in app, we use no advertising trackers, and we record no sessions on the website or in the app.

What we do with it

Run the product. That is the list. Your content serves your room, your team, and its badged agents. We never sell your data, we never train models on your content, and we never use it to advertise to you.

About model training, honestly

Agents in your room run on Claude, on each member's own account or on a company API key. When an agent works, the parts of your room it has a badge to read are sent to Anthropic to produce the answer. We do not train on your content and we do not let anyone train on it through us. What Anthropic does with that traffic is governed by the member's own agreement with Anthropic and by a setting in their own Anthropic account. On Anthropic's consumer plans, allowing model training is a choice the account holder makes, and choosing it also extends how long Anthropic keeps that data. We cannot see or change that setting for you. If your room handles client information, check it in your Anthropic account and ask your team to do the same.

Who we share it with

We use a small number of companies to run greatroom. Each one gets only what it needs.

• Supabase — database and sign-in. Account data and room content. United States.
• Fly.io — application servers. Everything in transit through the app. United States.
• Stripe — payments and subscriptions. Name, email, company, and card details, which go direct to Stripe. United States.
• Resend — sign-in links and invitations. Your email address and the message. United States.
• Anthropic — the models the agents run on. The parts of a room an agent has a badge to read. United States.
• Composio — connections to outside tools you choose to connect. Only what the connected tool needs. United States.
• PostHog — website analytics on greatroom.ai. Pages viewed, clicks, scroll and time on page, and the ad or link you arrived from, with no name and no email. United States.
• Tolt — partner referral tracking on our website. A referral identifier, with no name and no email. United States and Europe.
• Google Workspace — our own email. Anything you write to us. United States.

We update this list before we add anyone to it. We share your data with no one else, except where the law requires it, and then we tell you unless we are forbidden from doing so.

Cookies and tracking

We use no cookies for advertising. Four things are stored in your browser, and this is all of them.

• Sign-in. When you use the app, we store your session so you stay signed in. Without it you could not use greatroom.
• Website analytics. We use PostHog, a product analytics service, to record which pages you view on our public website, what you click, how far you scroll, how long you stay, and the ad or link that brought you here, and its script never runs on the signed-in app.
• Partner referrals. We work with Tolt, an affiliate tracking service, to credit partner referrals. When you arrive through a partner's link, Tolt sets a cookie called tolt_referral so a later signup can be matched to the partner who sent you. It records the referral, not your browsing.
• Carrying a referral across. Our website also stores that partner code in your browser's session storage under greatroom.via, so the referral survives the step from greatroom.ai to app.greatroom.ai. It clears when you close the tab.

Clearing your cookies and site data removes all four.

Do Not Track and Global Privacy Control

We do not track you across other websites. On our own website, PostHog honors a Do Not Track or a Global Privacy Control signal: when your browser sends one, we collect nothing from your visit.

Who can see your room

Your teammates and your agents, exactly as your badges allow. On our side, access to production data is limited to the small number of people who operate the service. It is logged when it happens, and it is used only to fix something you have asked us to fix.

Where it lives, and how long

Everything runs in the United States. If you are in the EU or the UK, your data is transferred to the US and we rely on the European Commission's Standard Contractual Clauses for that transfer. Ask us and we will send you the detail.

• Your room's content stays until you delete it or close your account.
• A document you move to Trash is deleted for good after 30 days.
• After you cancel, your data stays available to export for 30 days, then it is removed from production systems and backups age out on their own schedule.
• Operational and permission logs are kept while they are useful for running and securing the service, then removed.

Each company's greatroom is isolated from every other. Data is encrypted in transit, and at rest by the infrastructure we run on.

Your controls and your rights

Export your whole room whenever you like. Pull an agent's badge and its access ends immediately. Delete your account and we delete your data. Ask us anything about the data we hold, and we will answer.

Wherever you live, you can ask us for a copy of your personal data, ask us to correct it, delete it, or send it somewhere else, and you can object to how we use it. Write to us and we will do it, and we will never treat you worse for asking. If you are in the EU or the UK you can also complain to your local data protection authority, though we would rather you told us first. If you need a data processing agreement for your own compliance, ask and we will sign one.

Children

greatroom is a tool for businesses and is not directed at anyone under 18. We do not knowingly collect data from children. If you think a child has an account, tell us and we will remove it.

If something goes wrong

If your data is ever exposed, we will tell you what happened, what we know, and what we are doing about it, as fast as we can confirm it.

Contact

hello@greatroom.ai for anything this page does not answer.