Skip to content
ProductOS

Privacy Policy

Effective 13 October 2026

This policy explains how All-Here Technologies Private Limited (“we”, “us”) handles personal information when you use ProductOS (the “Service”). For content inside a company workspace, the organization that owns the workspace decides how it is used, and we process it on their behalf. Read this together with our Terms of Service.

1. Information we collect

  • Account details — your name, email address, a hashed password (we never store it in plain text) and, if you sign in with Google or Apple, the account identifier and email address the provider shares with us.
  • Profile and company details you choose to give during onboarding or in settings, such as job role, team size, goals, tools, company name, industry, company size and product stage.
  • Workspace content — feedback items, initiatives, documents and their versions, comments, approvals, roadmap data, uploaded files, and content you import from connected services.
  • Connected-service data — if you connect Slack, Gmail, an issue tracker or another service, the access tokens needed to reach it (stored encrypted) and the messages or records you choose to import.
  • Usage and security data — sign-in sessions (device type, IP address, browser user agent, times), an audit log of important actions, AI usage counts, and server logs used to keep the Service running and secure.

2. How we use it

  • to provide the Service: authenticate you, store and show your content, run imports, send the emails you need;
  • to personalize it: suggest a workspace setup, starter initiatives, connectors and terminology, and give the AI assistant context about your company and role;
  • to keep it secure: detect abuse, rate-limit sign-in attempts, investigate incidents and keep an audit trail;
  • to support you and improve the Service, using aggregated usage information;
  • to comply with law.

We do not sell personal information, we do not use it for advertising, and we do not use your content to train AI models. Where the GDPR or similar laws apply, we rely on performance of our contract with you, our legitimate interests in securing and improving the Service, your consent where we ask for it, and legal obligations.

3. AI processing

When you use an AI feature, the relevant content you are allowed to see — for example the feedback, initiative or document you selected, plus your company profile — is sent to our AI model provider, Anthropic, to generate the result. Anthropic processes it under its commercial terms and does not use it to train models. Results and their source references are stored in your workspace. You can choose not to use AI features.

4. Service providers

We share information only with providers that help us run the Service, under contracts that restrict their use of it:

  • Vercel — application hosting and delivery;
  • Neon — managed PostgreSQL database where your account and workspace data, including uploaded files, are stored;
  • Anthropic — AI model processing (see above);
  • Resend — sending account emails such as verification, password reset and invitations;
  • Google and Apple — only if you choose to sign in with them;
  • services you connect yourself, such as Slack, Google (Gmail) or your issue tracker.

These providers may process data in the United States and other countries. Where required, transfers are protected by appropriate safeguards such as standard contractual clauses. We may also disclose information if required by law, to protect rights and safety, or as part of a merger or acquisition, in which case this policy will continue to apply.

5. Cookies

We use only strictly necessary cookies: pos_session keeps you signed in (HttpOnly, up to 30 days) and pos_oauth protects Google and Apple sign-in for up to 10 minutes. The app also stores small preferences in your browser, such as your last workspace and theme. We do not use advertising or third-party analytics cookies.

6. Retention

We keep account and workspace data while your account or the workspace is active. Password-reset and verification links expire within 60 minutes and 48 hours. When you ask us to delete your account, we delete or anonymize your personal information within 30 days, except where we must keep it for legal, security or dispute-resolution purposes. Content in a company workspace stays with that workspace and is controlled by its owners. Backups are overwritten on a rolling basis.

7. Security

We use encrypted connections (HTTPS), hashed passwords and session tokens, encrypted storage of connector credentials, role-based access controls, and an audit log. No system is perfectly secure; if we become aware of a breach affecting your information we will notify you as required by law.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can update your profile and password in Account settings, disconnect services in workspace settings, and workspace admins can export workspace data. For any other request, contact us at vaibhav@allhere.co.in. You may also complain to your local data protection authority.

9. Children

The Service is not intended for anyone under 16, and we do not knowingly collect their information.

10. Changes

We will post updates here and change the effective date. If a change is material we will notify you by email or in the app before it takes effect.

11. Contact

All-Here Technologies Private Limited
Privacy questions and requests: vaibhav@allhere.co.in