Privacy Policy

Last updated: October 13, 2026 (Claude models through Vertex AI, and where AI requests are processed)

This policy explains what information Itasca Innovation, Inc. ("Itasca", "we", "us") collects through the Itasca platform at platform.itascainnovation.ai and the apps we host under apps.itascainnovation.ai and our customers' own domains (together, the "Platform"). It explains what we do with that information and the choices you have.

Two kinds of information

Information about you as a user of the Platform. If you sign in to the Platform, we hold an account for you. For this information, we decide how it is used.

Information inside our customers' apps. Organisations use the Platform to build and run their own apps. What those apps collect, such as records, forms and uploaded files, belongs to the organisation that runs the app. We store and process it on that organisation's behalf and under its instructions. If you use an app run by an organisation, that organisation's own privacy practices apply to what the app collects. Questions about that information are best sent to the organisation first. We will help them answer.

What we collect

Account information. When you sign in with Google or Microsoft, we receive your email address, your name, and your profile picture if one is available. We only accept an email address the provider has verified. We record the organisation you belong to, the role and permissions it has given you, and whether you are active or suspended. An organisation's administrator, or Itasca, may also add your email address so that you can sign in.

Sign-in by email. Where an organisation allows it, you can sign in with a link we email to you. We send that email through our email provider. The link works once and expires shortly after it is sent.

Activity. We keep a record of significant events: signing in, deploying or changing an app, connecting an assistant, and asking for help. For each app, we record each day which signed-in people used it, how many requests it received, and how those requests arrived: in a browser, through an AI assistant, or from another app. We do not keep a log of each page you view. This record is shown to your organisation's administrators and to Itasca, so they can see how their apps are used. When you open an app, the Platform tells that app who you are (your email address, your name, and your organisation) so the app can decide what you may do.

What you send us. This includes help requests, replies, feature suggestions, votes and comments, along with the page or screen they were sent from.

App source code and data. For organisations that build apps, this covers the app's source code, every deployed version, its database, files its users upload, settings, and keys or connections the organisation has given it.

Connected services. If you connect an app to another service, such as a Google, Microsoft or HubSpot account, we store the access that service grants. We keep it in an encrypted secret store and use it only for that app. You can disconnect it at any time.

AI usage. When an app makes an AI request through the Platform, the request is sent to Google's Vertex AI to produce an answer, from one of Google's Gemini models or one of Anthropic's Claude models that Vertex AI provides. We record the model, the amount used, the cost and the time taken. We do not keep the text of the request or the answer.

Technical information. Our hosting provider records the requests that reach the Platform and its apps. These records include addresses, times and error messages, and are used for running and securing the service.

Cookies

We use one cookie: a session cookie that keeps you signed in. It is required for the Platform to work. We do not use advertising or tracking cookies, and we do not use third-party analytics on the Platform. Apps we host are not allowed to set cookies through the Platform.

How we use information

We use the information above to:

• sign you in and apply the access your organisation has set;
• run, deploy, and host apps;
• answer help requests and route feature suggestions to the right people;
• send emails you have asked for or that your organisation has turned on, such as sign-in links and replies to your requests;
• measure usage, including AI costs, so organisations can see what they use;
• keep the Platform secure, investigate problems, and prevent abuse;
• meet legal obligations.

We do not sell personal information. We do not use it for advertising. We do not use customers' app data or your requests to train AI models.

Who we share it with

We share information only as needed to run the Platform:

• Google Cloud hosts the Platform, its databases, file storage, logs and AI processing, in the United States, or globally when the AI model an app uses is one that Google provides through its global service.
• Google and Microsoft handle sign-in when you choose them.
• Our email provider (Resend) delivers the emails described above.
• Slack. When a help request arrives, our team gets a short notice in Slack naming the organisation and the app. It does not include your message or your email address.
• Services you connect receive what you authorise when you connect them.
• Your organisation's administrators can see who in their organisation has access, and what activity there has been on their apps.
• Legal and safety. We may disclose information when the law requires it, or to protect the rights, safety and security of our users, our customers or the public.
• Business transfers. If Itasca is reorganised, merges or is sold, this information may pass to the successor, under this policy.

How long we keep it

• Who used each app is kept by name for 13 months. After that, only the daily counts are kept.
• Your account is kept while you or your organisation use the Platform. When it is removed, your access ends and we delete or anonymise your personal information within a reasonable time. We may keep records we need for legal, security or accounting reasons.
• App source versions, databases and files are kept while the app exists. A deleted app is kept for a short period so it can be restored, then its remaining data is permanently removed on request or during routine cleanup.
• Records kept by our hosting provider are retained under that provider's retention periods.

Security

Apps on the Platform are private by default and reachable only through it. Connections are encrypted. Secrets and connected-service tokens are kept in a dedicated secret store and are never shown back to anyone. Each organisation's apps run under their own identity and keep their data in their own database. No system is perfectly secure, but we work to protect your information and will notify affected customers of a breach as the law requires.

Your choices and rights

You can ask us to show you, correct, export, or delete the personal information we hold about you. You can also object to or restrict how we use it. Depending on where you live, you may have specific rights under laws such as the GDPR or US state privacy laws. We honour those rights, and we will not treat you differently for using them.

For information inside an organisation's app, we will usually pass your request to that organisation, because it decides how that information is used.

To make a request, write to privacy@itascainnovation.ai. We may need to confirm your identity before acting on it.

International users

The Platform is operated in the United States. If you use it from elsewhere, your information will be transferred to and processed in the United States. An AI request made through an app whose model Google provides through its global service may be processed in another country.

Children

The Platform is meant for businesses and is not directed to children under 16. We do not knowingly collect their personal information.

Changes

If we change this policy, we will post the new version here and update the date at the top. If a change is significant, we will let customers know before it takes effect.

Contact

Itasca Innovation, Inc. privacy@itascainnovation.ai