Privacy Policy

1. Introduction

Exlo AI, Inc. ("Company," "we," "our," or "us") operates Sagework, an AI-powered platform for engineering managers. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you participate in the Sagework beta program.

Sagework is currently in beta / early access. Our data practices may evolve as the product matures. We will notify you of any material changes to this policy.

2. Information We Collect

We collect the following types of information:

Account Information

• Name and email address when you sign up for the waitlist or create an account
• Organization and role information you provide
• Authentication credentials (stored securely, never in plaintext)

Usage Data

• How you interact with the service (features used, pages visited, actions taken)
• Device information (browser type, operating system)
• Log data (IP address, access times, referring URLs)

Integration Data

• Data from third-party tools you connect, such as GitHub, Jira, Slack, Linear, Zoom, and Google Calendar
• OAuth tokens required to access your connected services (stored encrypted)
• Metadata from your integrations used to provide features (e.g., pull request activity, ticket status, calendar events)
• Meeting recordings and transcripts from Zoom meetings where you have opted in to the Sagework Notetaker bot

Feedback and Communications

• Feedback, suggestions, and bug reports you submit
• Messages you send to us via email or in-product channels
• Survey responses and beta program participation data

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Sagework service
• Process your data through AI models to deliver features (daily briefings, 1:1 prep, performance insights)
• Analyze usage patterns to improve the product during the beta period
• Communicate with you about the beta program, updates, and changes
• Respond to your questions, feedback, and support requests
• Detect and prevent security issues, fraud, or abuse

We do not use your information for advertising. We do not sell your data to third parties. We do not use your data to build profiles for ad targeting.

4. Third-Party Services

Sagework relies on the following third-party services to operate. Data may flow to these services as described:

Anthropic (Claude API) -- AI Processing

Your data is processed by Anthropic's Claude AI models to provide Sagework's features. This includes content from your connected integrations (e.g., pull request summaries, ticket descriptions, meeting context) sent as part of AI prompts. See Section 5 for detailed AI disclosures.

Cloud Hosting

Our infrastructure is hosted on cloud services (Supabase, Vercel) that store and process your account data and application state. These providers maintain their own security certifications and privacy practices.

Analytics

We use Vercel Analytics to understand how users interact with the service. Analytics data is aggregated and used to improve the product. We do not use analytics services that track you across other websites.

Recall.ai -- Meeting Recording & Transcription

When you opt in to the Sagework Notetaker bot for a Zoom meeting, audio is captured and transcribed by Recall.ai, a third-party meeting bot platform. Recall.ai automatically deletes all audio recordings within 2 hours of meeting completion. Sagework does not store raw audio -- only the resulting transcript, which is encrypted at rest (AES-256-GCM) and accessible only to the authenticated user who initiated the bot. See Section 6 for retention details.

Authentication

We use third-party authentication providers (e.g., OAuth via Google, GitHub) to securely manage sign-in. We do not store your passwords for these services.

5. AI-Specific Disclosures

Because Sagework is an AI-powered product, we want to be transparent about how AI processes your data:

AI Processing

User data -- including information from your connected integrations (GitHub, Jira, Slack, etc.) -- may be processed by Anthropic's Claude AI models to generate insights, summaries, and recommendations. This is core to how Sagework provides value.

No Training on Your Data

We do not use your data to train AI models. Sagework operates on Anthropic's commercial API, which has a zero data retention policy. Under Anthropic's commercial terms, your inputs and outputs are not used to train or improve Anthropic's models.

No Persistent AI Storage

Conversations and data processed by the AI are not retained by Anthropic beyond the duration of the API request. Once a response is generated, the AI provider does not store your prompt or the response. Anthropic's API has a zero data retention policy for commercial customers.

Human Review

AI-generated content (performance summaries, 1:1 agendas, feedback analysis) is presented to you for review. You are always in control of what gets shared, saved, or acted upon. Sagework is a tool to assist your judgment, not replace it.

6. Data Retention

We retain your data as follows:

• Active accounts: Data is retained for the duration of the beta period and your active participation
• After account deletion: Your data will be deleted within 30 days of account deletion request. Some anonymized, aggregated data may be retained for analytics purposes
• On-demand deletion: You can request deletion of your data at any time by contacting us at founders@sagework.ai
• Zoom integration data: OAuth tokens are deleted immediately when you disconnect Zoom. Meeting audio is auto-deleted by Recall.ai within 2 hours. Transcripts are retained until you delete them or request account deletion

7. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS)
• Encryption at rest: Stored data is encrypted at rest using industry-standard encryption
• Access controls: Access to user data is restricted to authorized personnel on a need-to-know basis
• OAuth tokens: Integration tokens are stored encrypted and are never exposed in logs or application output
• Regular review: We regularly review and update our security practices as the product evolves

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Information Sharing

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following circumstances:

• Service providers: With third-party services that help us operate (as described in Section 4), under agreements that protect your data
• Legal requirements: When required by law, regulation, legal process, or governmental request
• Safety: To protect the rights, property, or safety of Exlo AI, our users, or the public
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users
• With your consent: When you explicitly agree to sharing

9. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Portability: Request your data in a structured, commonly used format
• Withdrawal of consent: Withdraw consent for data processing at any time (which may result in inability to use certain features)
• Opt-out of communications: Unsubscribe from non-essential emails at any time

To exercise any of these rights, contact us at founders@sagework.ai. We will respond to your request within 30 days.

10. Beta-Specific Notice

Sagework is in an early access / beta phase. This means:

• Our data practices may evolve as the product matures and we learn from beta usage
• We may collect additional types of data as new features are introduced
• We will notify you of material changes to this privacy policy via email or in-product notification
• We welcome your feedback on our privacy practices at any time

11. Children's Privacy

Sagework is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date. For significant changes, we will also notify you via email. Your continued use of the service after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy, your data, or your rights, please contact us:

• Email: founders@sagework.ai
• Company: Exlo AI, Inc. (DBA Sagework)