PrivacyPolicy

This Privacy Policy ("Policy") explains how RoryPlans, Inc. ("RoryPlans", the "Company", "we" or "us") collects, uses, shares, stores and deletes information when you use roryplans.ai, the RoryPlans web application, the RoryPlans app for Microsoft Teams, the RoryPlans MCP server and connectors, and our related services (together, the "Services").

RoryPlans is an AI work platform. You describe the work you need done, RoryPlans turns it into plans of goals and tasks, and AI agents that you or your team configure carry out tasks using the tools and data access you give them. By using the Services, you consent to the data practices described in this Policy.

Information We Collect

• •Account information. When you sign in with Google, Microsoft, GitHub or Slack, we receive and store your name, email address and profile picture from that provider, along with the sign-in tokens it issues.
• •Content you create or upload. Plans, goals, tasks, comments, chats with RoryPlans, agent instructions and settings, templates, knowledge documents and other files you upload, and the documents and messages agents produce.
• •Agent activity. What an agent was asked to do, the steps and tools it used, its results, and where results were delivered (for example, email recipients or a Microsoft Teams or Slack channel).
• •Information from services you connect. Described in "Connected Services and Microsoft 365" below.
• •Billing information. Payments are processed by Stripe. Card details are entered on Stripe's pages and go directly to Stripe; we do not store card numbers. We store your Stripe customer and subscription identifiers, your plan and your credit balance.
• •Usage and device information. IP address, browser and device type, operating system, pages viewed and actions taken in the Services, collected through our logs and analytics tools. Our analytics tools use cookies and similar technologies; see our Cookie Policy.
• •Communications. Messages you send us, for example to support@roryplans.ai.

We collect this information when you create an account, use the Services, connect a third-party service, buy a subscription or contact us.

How We Use Your Information

• •to provide and operate the Services, including generating plans, running agents and delivering their results to the destinations you choose (such as email, Microsoft Teams, Slack or a document)
• •to process payments, manage subscriptions and credits, and send you notices about your account and billing
• •to keep the Services secure, prevent abuse, and investigate and fix errors
• •to understand how the Services are used and improve them
• •to communicate with you about the Services, including updates and, where permitted, promotional emails you can opt out of
• •to comply with legal obligations and enforce our agreements
• •for any other purpose with your consent

We do not sell, rent or lease your personal information. We do not use your information, or any data we receive from Microsoft 365 or Microsoft Teams, for advertising.

We do not use customer content to train or fine-tune AI models.

AI Processing

RoryPlans uses large language models to generate plans, answers and agent output. To do this, we send the relevant content (your prompts, the plan or task context, the files or messages an agent reads, and tool results) to an AI model provider, which returns a response. Depending on the model in use, these providers are Google (Gemini API and Vertex AI), Anthropic, OpenAI and Microsoft (Azure OpenAI), reached directly or through the Vercel AI Gateway. When an agent searches the web, its search queries are sent to Tavily.

These providers process the content to return a response, under their terms for business API customers. Requests through the Vercel AI Gateway are sent only to providers with zero data retention agreements, so those providers do not keep your prompts or outputs. Requests to Google's Gemini API use Google's paid service, under which Google does not use prompts or responses to improve its products and keeps them only for a limited time to detect abuse. Our AI providers do not train their models on your content.

We record AI requests and responses in our tracing tool (Braintrust) to investigate errors and improve quality.

AI output can be inaccurate or incomplete. Review important results before you rely on them. To report harmful or wrong AI output, email support@roryplans.ai.

Connected Services and Microsoft 365

You choose which services to connect. Connecting a service lets RoryPlans and your agents read or act in it on your behalf, within the permissions you or your administrator grant. Each connected service also handles your information under its own privacy policy.

RoryPlans app for Microsoft Teams

An agent owner can connect a Teams channel to a RoryPlans agent. The app only receives channel messages that @mention it. For each such message we receive the message text; the sender's Microsoft user ID and display name; and the IDs of the Microsoft 365 tenant, team, channel, conversation and message. The message text is sent to the agent's AI model, and the agent's reply is posted in the same thread.

We keep the channel connection (tenant, team and channel IDs and names, and the agent owner) until it is removed; a record of each agent run, including the tenant, team and channel; the full step-by-step transcript of a run for 24 hours; the link between a Teams thread and an agent for 30 days after the thread starts; and a record of which teams have installed or removed the app.

Microsoft Teams access on your behalf

If you connect your Microsoft account for Teams, you consent on Microsoft's sign-in screen to these Microsoft Graph permissions:

• •sign you in, read your profile and keep access until you disconnect (openid, profile, email, offline_access, User.Read)
• •read basic profiles of people in your organization, so agents can find message recipients (User.ReadBasic.All)
• •read the names of your teams and channels (Team.ReadBasic.All, Channel.ReadBasic.All)
• •read channel messages, so agents can read and summarize the channels you choose (ChannelMessage.Read.All)
• •post channel messages and send chat messages, so agents can deliver results (ChannelMessage.Send, Chat.ReadWrite)

We store the access and refresh tokens Microsoft issues so agents can act for you until you disconnect. Some connections are made through Vercel Connect; for those, Vercel holds the tokens and we store only the connection's name and identifiers.

Microsoft 365: SharePoint and Microsoft Forms

An administrator of your organization can connect Microsoft 365 by granting the RoryPlans application two application permissions: Sites.Selected (SharePoint) and Forms.Read.All (Microsoft Forms). With Sites.Selected, RoryPlans can only reach the SharePoint sites your administrator grants to it one by one. Microsoft grants Forms.Read.All for the whole organization; RoryPlans only reads forms that a team owner or administrator registers in RoryPlans.

Agents read files from granted sites and responses from registered forms when a task needs them. That content is sent to the AI model and becomes part of the run's history and results. We store the tenant ID, name and domains; the administrator who connected it; the IDs, names and addresses of granted sites; the IDs, titles and response counts of registered forms; and which RoryPlans users may use them. The administrator's sign-in token used during setup is not stored.

Slack, GitHub, Jira, WinTeam, email and AI assistants

• •Slack: agents can read messages, files, reactions and pins, read channel information and user profiles (including email addresses), and post messages, files, reactions and pins in the workspaces and channels you connect. We store the tokens Slack issues and the workspace, user and channel identifiers.
• •GitHub: we store your app installation ID and the list of repositories it covers.
• •Jira: we store your Jira site address, Jira user ID and email, and the tokens Atlassian issues.
• •WinTeam and your organization's email server: we store the connection details and credentials you enter, with API keys and passwords encrypted.
• •AI assistants (MCP): when you authorize an assistant such as Claude or Microsoft Copilot Studio, it can read and update your plans through our MCP server with the access you granted, until you revoke it.

Stopping access

• •Disconnect in RoryPlans. Disconnecting Microsoft Teams, Slack, GitHub or Jira in RoryPlans deletes the tokens and connection details we store for that service. Disconnecting Microsoft 365 stops RoryPlans using it and removes users' access to it; we keep a record of the connection and its sites and forms, marked as removed.
• •Revoke consent at Microsoft. Disconnecting in RoryPlans does not withdraw the consent you gave Microsoft. You can remove RoryPlans from the apps with access to your Microsoft account, and an administrator can delete the RoryPlans enterprise application in the Microsoft Entra admin center, which removes all of its permissions, including SharePoint site grants.
• •Remove the Teams app. Removing the RoryPlans app from a team stops it receiving messages from that team. Channel connections and run history already created stay in RoryPlans until an agent owner removes them or you ask us to delete them.

Service Providers and Sharing

We share information with service providers that process it on our behalf to run the Services, under data processing agreements that let them use it only to provide their services to us and require them to keep it confidential. Our service providers are:

• •Vercel: application hosting, AI Gateway, Vercel Connect, code sandboxes for agents and web analytics
• •Neon: database
• •Upstash: key-value storage
• •Google Cloud: file storage (Cloud Storage) and AI models (Vertex AI and Gemini API)
• •Microsoft: AI models (Azure OpenAI), Azure Bot Service for the Teams app, and Microsoft sign-in
• •Anthropic and OpenAI: AI models
• •Tavily: web search for agents
• •Stripe: payments
• •Braintrust: AI tracing and quality monitoring
• •Segment: product analytics, which forwards usage data (including your name and email address when you are signed in) to Mixpanel and Google Analytics, and loads Hotjar to analyze how pages are used
• •Google Workspace: outgoing email

We also share information with the services you connect when you or your agents act in them, and with other members of your team according to the sharing settings you choose.

The Company may disclose your personal information, without notice, if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to the edicts of the law or comply with legal process served on the Company or the site; (b) protect and defend the rights or property of the Company; and/or (c) act under exigent circumstances to protect the personal safety of users of the Company, or the public.

Where Data Is Stored

RoryPlans is operated from the United States. Our application runs on Vercel in its US East region (Washington, D.C.), and our main database is hosted by Neon on Amazon Web Services in US East (N. Virginia). When we use Google Vertex AI, processing happens in US regions. Files are stored in Google Cloud Storage, and key-value data is stored by Upstash on Amazon Web Services in US East (N. Virginia).

Our other service providers may process data in the United States or other countries where they operate. If you use the Services from outside the United States, your information is transferred to and processed in the United States.

How Long We Keep Data

Unless a shorter period is listed below, we keep information until you delete it or delete your account.

• •Account information and sign-in tokens: while your account exists.
• •Plans, tasks, chats, agent settings and generated documents: until you delete them or your account.
• •Uploaded files (chat attachments, task and agent files, knowledge documents): until you delete them or ask us to. They are not yet removed automatically when you delete your account.
• •Agent run history (each run's status, result and delivery details): until you ask us to delete it. It is not yet removed automatically when you delete an agent or your account.
• •Step-by-step transcripts of agent runs: 24 hours.
• •Test and preview runs and their documents, and messages you send to steer a running agent: 30 days.
• •Links between a Microsoft Teams or Slack thread and an agent: 30 days.
• •Email recipients that agents work out from your task descriptions: 180 days.
• •Unfinished document exports: about one hour.
• •Tokens for connected services: until you disconnect the service or delete your account.
• •Sign-in, security and rate-limiting records: from a few minutes to a few hours.
• •Logs, traces and analytics held by our service providers (Vercel, Braintrust, Segment, Mixpanel, Google Analytics and Hotjar): each provider's standard retention period.
• •Database backups: 30 days.
• •After you delete your account, we keep your email address and whether it has used a free trial, so the trial cannot be claimed again. Stripe keeps payment records as its own legal obligations require.

Your Rights and Choices

You can ask us for a copy of your personal information in a portable format, or ask us to correct or delete it, by emailing support@roryplans.ai. Depending on where you live, you may also have the right to object to or restrict certain processing, to withdraw consent you have given, and to complain to your local data protection authority. We will not treat you differently for exercising these rights.

If you use RoryPlans as a member of an organization's team, that organization controls the content in its team workspace, and we process that content on its behalf. We may refer requests about that content to your organization.

Deleting Your Data

• •In the app. You can delete plans you own, chats, files and agents at any time. Deleting a plan removes its tasks; deleting a chat removes its messages.
• •Delete your account. On your profile's Linked Accounts page, choose Delete Account and type your email address to confirm. This permanently deletes your profile and sign-in connections, the plans you own, your chats and documents, your agents with their tasks and schedules, teams you own, and the tokens for your connected services, and cancels your subscriptions. Uploaded files, agent run history, and copies in backups and service-provider logs are not yet removed automatically; email us to have them removed.
• •By email. Write to support@roryplans.ai from the email address on your account to ask us to delete your data, give you a copy of it or correct it. We will respond within 30 days.

Disconnecting an integration or removing the Teams app stops new data from reaching us; see "Stopping access" above for what each one deletes.

Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will:

• •Delete your personal information from our records; and
• •Direct any service providers to delete your personal information from their records.

Please note that we may not be able to comply with requests to delete your personal information if it is necessary to:

• •Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, and provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us;
• •Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;
• •Debug to identify and repair errors that impair existing intended functionality;
• •Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law;
• •Comply with the California Electronic Communications Privacy Act;
• •Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent;
• •Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us;
• •Comply with an existing legal obligation; or
• •Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Security of your Personal Information

We protect your information from unauthorized access, use or disclosure with these measures:

• •Encryption in transit: the Services and our connections to our database and service providers use TLS (HTTPS).
• •Encryption at rest: our database (Neon) and file storage (Google Cloud Storage) encrypt stored data at rest. Our key-value store (Upstash), which holds plans and agent run records, is not encrypted at rest; data in it is protected in transit and by access controls.
• •Extra protection for some credentials: WinTeam API keys and organization email (SMTP) passwords are encrypted with AES-256-GCM before they are stored, and RoryPlans API tokens and OAuth client secrets are stored only as hashes. Other connected service tokens rely on the storage encryption above.
• •Private file storage: files are kept in a private storage bucket and are only shared through links that expire.
• •Access control and least privilege: requests are checked against the user's account, team role and plan sharing settings; Microsoft 365 access uses Sites.Selected, so RoryPlans can only reach SharePoint sites an administrator grants; sign-in and connection flows use signed, single-use state; and sensitive operations are rate limited.
• •Secrets: production keys and credentials are stored in our hosting provider's environment configuration, with access limited to authorized personnel.
• •Incident notification: if we learn of a security incident that affects your personal information, we will notify affected customers without undue delay and no later than 72 hours after confirming the incident, in addition to any notice the law requires.

Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, you acknowledge that: (a) there are security and privacy limitations inherent to the Internet that are beyond our control; and (b) the security, integrity, and privacy of any and all information and data exchanged between you and us through the Services cannot be guaranteed.

Children Under Thirteen

The Company does not knowingly collect personally identifiable information from children under the age of 13. If you are under the age of 13, you must ask your parent or guardian for permission to use this application.

Email Communications

From time to time, the Company may contact you via email for the purpose of providing announcements, promotional offers, alerts, confirmations, surveys, and/or other general communication.

If you would like to stop receiving marketing or promotional communications via email from the Company, you may opt out of such communications by replying STOP or clicking on the unsubscribe button.

Changes to This Statement

The Company reserves the right to change this Policy from time to time. For example, when there are changes in our services, changes in our data protection practices, or changes in the law. When changes to this Policy are significant, we will inform you. You may receive a notice by an email to the primary email address specified in your account, by a prominent notice on roryplans.ai, and/or by an update to this page. Your continued use of the application and/or services available after such modifications will constitute your: (a) acknowledgment of the modified Policy; and (b) agreement to abide and be bound by that Policy.

Contact Information

The Company welcomes your questions or comments regarding this Policy. To ask a privacy question, request deletion of your data, report a security issue or report harmful AI output, or if you believe that the Company has not adhered to this Policy, please contact the Company at: