Privacy Policy

Information we collect

Information you provide

• Account information. When you create an account we collect your name, email address and profile details such as a display name or avatar. If you sign in through a third-party identity provider, we receive the information that provider shares with us, such as your name, email address and profile picture.
• Customer Content. The content you and your team create, upload or store in a workspace, including threads, comments, @mentions, attachments, files, messages to the AI assistant, and the agents and schedules you configure.
• Communications. When you contact us for support or otherwise, we keep the contents of your message and your contact details so we can respond.
• Billing information. If you purchase a paid plan, payments are handled by our payment processor. We receive limited details such as your billing name, address and the last four digits of your card; we do not store full payment card numbers.

Information collected automatically

• Usage and log data. IP address, browser and device type, operating system, the pages and features you use, timestamps, referring URLs, and error and diagnostic logs.
• Cookies and similar technologies. Used to keep you signed in, secure your session and remember your preferences. See Cookies and similar technologies.

Information from others

• Other workspace members may invite you by email, @mention you, or post content that includes information about you.
• Integrations you connect, such as MCP clients or local agents, may send us information at your direction.

How we use information

We use the information we collect to:

• Provide, operate and maintain the Services, including storing and displaying your content.
• Power AI features such as thread summaries, the chat assistant, and agents you publish, connect or schedule.
• Authenticate users, secure accounts, and detect and prevent fraud, abuse and security incidents.
• Communicate with you about the Services, including service notices, security alerts and support responses, and — where permitted — product updates you can opt out of.
• Understand how the Services are used, diagnose problems, and improve performance and features.
• Comply with legal obligations and enforce our terms.

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases: performance of our contract with you; our legitimate interests in operating, securing and improving the Services; compliance with legal obligations; and your consent, where required.

AI features

Stele's AI features — thread summaries, the chat assistant and agents — work by reading and writing the same content you do. When you use them:

• The Customer Content needed for a request, such as a thread, its comments or the files an agent reads, is sent to the third-party AI model providers we engage to generate a response.
• The assistant and agents reach content through MCP with the same permissions as the account they act for. They cannot access content that account cannot.
• We do not use Customer Content to train AI models, and we do not permit our AI model providers to use it to train theirs.
• AI-generated output is stored in your workspace like any other content.
• If you connect a local agent or an external MCP client, information that client retrieves is handled under that client's own terms and privacy practices.

How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:

• Within your workspace. Content you post is visible to other members of the spaces and workspaces where you post it, according to their permissions. Your name, email address and avatar are visible to other members of your workspaces.
• Service providers. Vendors that host our infrastructure, store files, provide AI models, process payments, send email and support our operations. They may use the information only to provide services to us, under contractual confidentiality and security obligations.
• Workspace administrators. If your account is provided by an organization, its administrators may access, manage, export or delete your account and content.
• Legal and safety. When we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property or safety of Stele, our users or the public.
• Business transfers. In connection with a merger, acquisition, financing, reorganization or sale of assets, in which case information remains subject to this policy.
• With your consent or at your direction.

Workspaces and your organization

If you use Stele through a workspace that an organization, such as your employer, owns or administers, that organization controls the Customer Content in the workspace, and we process it on the organization's behalf and according to its instructions. Requests about that content should be directed to the organization's administrator. This policy does not cover the organization's own privacy practices.

Data retention

We keep account information for as long as your account is active or as needed to provide the Services. Customer Content is kept until you or a workspace administrator deletes it, or until the workspace is closed. Deleted data is removed from our active systems within a reasonable period, and residual copies in backups are overwritten on a rolling schedule. We may keep some information longer where required for legal, security, fraud-prevention or dispute-resolution purposes.

Security

We use administrative, technical and physical safeguards designed to protect information, including encryption in transit and at rest, access controls and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your account has been compromised, contact us at privacy@stele.ai.

Your rights and choices

• Account and content. You can review and update your profile in the app, and export or delete content you have permission to manage.
• Email. You can opt out of product updates using the unsubscribe link in those emails. We will still send service and security messages while you have an account.
• Cookies. You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent you from signing in.

Depending on where you live — including the EEA, the UK, Switzerland, California and other U.S. states — you may have the right to access, correct, delete or receive a portable copy of your personal information; to restrict or object to certain processing; to withdraw consent; and not to be discriminated against for exercising these rights.

To make a request, email privacy@stele.ai. We will verify your identity and respond within the time required by applicable law. You may use an authorized agent to make a request on your behalf. If your request concerns content in an organization's workspace, we may refer you to that organization. You also have the right to lodge a complaint with your local data protection authority.

International data transfers

We and our service providers may process information in the United States and other countries whose data protection laws may differ from those where you live. Where required, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses.

Cookies and similar technologies

The Stele app uses strictly necessary cookies and local storage to keep you signed in, protect against cross-site request forgery and remember preferences. We do not use advertising cookies or third-party tracking on the Site or in the app. Because we do not track you across third-party websites, we do not respond differently to Do Not Track signals.

Children's privacy

The Services are built for teams and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

Third-party services

The Services may link to or integrate with third-party websites and services, including identity providers, MCP clients and agents you connect. Their collection and use of information is governed by their own privacy policies, not this one.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date at the top of this page. If a change is material, we will give you notice — for example by email or in the app — before it takes effect.

Contact us

If you have questions about this policy or our privacy practices, email us at privacy@stele.ai.