1. Who is responsible
Piot, based in Ireland, is the controller responsible for the personal data described in this policy when you use piot.ai and the Piot app. Contact us about privacy, access, deletion, or account closure at hello@piot.ai.
This policy covers Piot’s handling of your information. Google, websites you visit, and other services you use independently have their own privacy policies.
2. Information we process
- Account information: your Google account identifier, verified email address, and name, plus the sessions needed to keep you signed in.
- Conversations and task data: messages, AI responses, questions and answers, task instructions, schedules and time zones, generated files and links, and the information needed to resume and display your work.
- Connected-service information: the accounts you connect, their names and email addresses, access permissions and credentials, and the email, file, or calendar information retrieved for your tasks.
- Browser task information: websites visited by the agent, page content, actions and results, and browser-session information needed to carry out or resume a task. This can include information from accounts you sign into in that browser.
- Technical and support information: network and device information needed to deliver and secure the service, operational error information, and information you send when contacting us.
We receive information from you, from Google and other services you authorise, and from websites or documents involved in your tasks. That content can contain personal data about other people. Only provide or authorise access to information you are entitled to use.
3. Google account access
Google sign-in and optional integrations are separate. Signing in supplies identity information. Connecting an integration grants the permissions shown by Google. You can connect multiple accounts for each service.
- Gmail: read messages and relevant message content, find unread mail, compose and send messages, and manage messages and labels. The requested Gmail permission does not permit immediate permanent deletion that bypasses the trash.
- Google Drive: find, read, and manage files and related information for your requested tasks. This permission can cover your Drive, rather than only individual files selected in a picker.
- Google Calendar: list your calendars and read, create, update, or delete events within the access granted by your account.
Piot stores access and refresh credentials on its server so the agent can use a connection when needed, including for tasks you schedule. These credentials are not included in the agent’s AI prompts. Google data returned by a task can be included in its conversation, outputs, and saved task history.
4. Purposes and legal bases
Where the GDPR applies, we rely on the following legal bases, according to the processing involved:
- Providing the service under our agreement: creating and maintaining your account, responding to instructions, keeping your task history, performing authorised actions, and running your schedules.
- Consent: optional access or processing where we ask for your consent, including connecting an account. You can withdraw that consent through the controls below. Withdrawal does not affect processing that was lawful before it.
- Legitimate interests: protecting accounts and systems, preventing abuse, investigating errors, and responding to support requests, balanced against your rights.
- Legal obligations: complying with applicable law, responding to valid legal requirements, and handling data-protection requests.
Account and task information is needed to provide the relevant features; without it, those features may not work. Optional integrations are your choice. AI assists with your instructions; Piot does not use your personal data to make its own decisions about your legal rights or eligibility for essential services.
5. AI processing and other providers
To generate responses and decide how to perform your task, Piot sends relevant instructions, conversation context, and tool results to its configured AI inference provider. This can include Google email, file, or calendar content when needed for your task. The production configuration currently uses DeepSeek’s API. AI processing may take place outside the European Economic Area. Provider processing and retention depend on the applicable API arrangements; this policy does not promise zero retention by every provider.
We also use infrastructure and browser-service providers, including Amazon Web Services for managed browser sessions. These providers can process data needed to host the service or operate the browser, including pages and actions involved in browser tasks. External sites and services receive the information needed to carry out actions you request, such as the recipient and content of an email.
We may disclose information when required by law or reasonably necessary to protect users and the service. Any transfer of Google data must also comply with the Limited Use restrictions below. We do not sell personal data or share Google account data for advertising.
6. Google data and Limited Use
Piot’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements and applicable Google Workspace data policies.
Google account data is used to provide the user-facing features you request. Piot does not use it to train or improve general-purpose AI models, build advertising profiles, or determine creditworthiness. Providing relevant content to an inference service to answer your request is part of performing the requested feature, subject to these restrictions.
Human access to Google data is limited to the circumstances Google permits, such as your affirmative agreement to access specific information for support, necessary security investigations, legal requirements, or permitted internal use of aggregated and anonymised data.
7. Storage and retention
We save account information, conversations, task state, schedules, generated artifacts, and connected-account credentials on Piot’s server. We keep recovery backups that can contain copies of saved information. Saved history and backups currently have no fixed automatic expiry; they remain available to support your account, ongoing tasks, and recovery until deletion is requested or the data is otherwise removed.
Connection credentials in the active service are removed when you disconnect that integration. Previously saved outputs and backup copies are not erased just by disconnecting. Provider-held records may have separate retention periods under the relevant provider arrangements.
We assess deletion requests across active records and recovery copies. Some information may need to be retained for a specific legal obligation, security investigation, or legal claim; where that applies, we limit it to the purpose and period required. Contact us for information about retention or a deletion request.
8. Disconnecting, stopping tasks, and deleting data
- Use Settings → Connections to disconnect a Gmail, Drive, or Calendar account from Piot. Each service connection can be removed separately.
- Use your Google Account connections to revoke Piot’s Google access. Revoking the wider Google grant can affect multiple Piot connections.
- Pause or delete schedules to stop future scheduled work. Signing out or closing the app does not disable your schedules or stop tasks already running.
- Email hello@piot.ai to request account closure, deletion of saved conversations and connected-service data, or a copy of your information. We may need to verify that the request is yours.
Removing data from Piot does not delete original messages or files in Google, retract sent messages, or undo actions completed in other services. Manage those items with the relevant service.
10. International processing
Piot operates from Ireland, but its AI, infrastructure, and connected-service providers may process information in other countries, including outside the EEA. In particular, DeepSeek is based in China, and tasks can involve services operating internationally.
Where GDPR transfer rules apply, an appropriate transfer mechanism is required, such as an applicable adequacy decision or contractual safeguards together with any necessary additional measures. You can contact hello@piot.ai for information about the destinations and safeguards relevant to your data.
11. Security
Access to piot.ai uses HTTPS. Piot requires authentication for account data and checks account ownership when accessing conversations and connections. Integration credentials are kept on the server and are not exposed as AI tools or included in model prompts. No online service can guarantee absolute security; contact us promptly if you suspect unauthorised access or a security problem.
12. Your data-protection rights
Depending on your circumstances and applicable law, you can request access, correction, erasure, restriction, or portability of personal data, object to processing based on legitimate interests, and withdraw consent where processing relies on it. These rights are subject to legal conditions and exceptions.
Send requests to hello@piot.ai. We may ask for proportionate identity verification. We will respond within the time required by applicable law, normally one month under the GDPR, and explain any permitted extension.
You may also complain to the Data Protection Commission in Ireland or your local data-protection authority. You do not have to contact us first to exercise that right.
13. Children
Piot is intended for adults aged 18 and over. If you believe a child has provided personal data through Piot, contact us so we can investigate and take appropriate action.
14. Updates and contact
We will update this policy when our practices or relevant requirements change, revise the date above, and provide appropriate notice of material changes. Where required, we will obtain consent before using information for a new purpose.
Contact: Piot, Ireland. Email: hello@piot.ai. See also our Terms of Service.