Privacy Policy

The short version

• We control account, billing, website, support, security and product-telemetry data. For Customer Content (the data, files, prompts and other content you or your users put into or create with the Services), we act for you under our Data Processing Addendum.
• We do not use Customer Content to train or fine-tune AI models. Some Model Providers may keep request data (see “How we use AI and Model Providers”).
• We do not sell personal data for money. The X Pixel, which loads only if you turn on Personalized Advertising on www.erp.ai, may count as a “sale” or “sharing” under US state laws. You can switch it off at any time, and we honor Global Privacy Control.
• Proto keeps most data on your computer. Model requests in Proto Managed (the default) and with OpenRouter or Fireworks keys pass through our servers, which log them, and web search runs through our servers. When an error occurs, Proto automatically sends us a report containing the full session transcript, and there is currently no setting to turn this off.
• build.host logs the IP address and browser details of visitors to every hosted site and adds a small script to every hosted page.
• Optional analytics and advertising cookies load only after you allow them.

Who we are and how to contact us

ERP•AI US Inc. (“ERP•AI”, “we”, “us”) provides the Services: the ERP•AI platform at apps.erp.ai, the Proto desktop app, build.host, our APIs, our websites (including www.erp.ai, hi.erp.ai, status.erp.ai, protoagent.ai and proto.erp.ai, and our staging sites erpai.studio, app.erpai.studio and deskera.erp.ai) and related support.

• Address: ERP•AI US Inc., 2 Embarcadero Center, San Francisco, CA 94111, USA
• Privacy questions and requests, and security reports: legal@erp.ai
• Account support and account closure: care@erp.ai

Capitalized terms such as Customer Content, Customer Personal Data, Output, Agent, Authorized User, Hosted Content, Published App, Credits, Promotional Credits, Model Provider and Usage Data have the meanings in our Terms of Service. This policy is a notice, not a contract.

Scope and our two roles

This policy covers personal data we handle when you use the Services, visit our websites, contact us, join our programs or contests, invite someone or are invited, send us a legal notice, or report abuse. It does not cover third-party services you connect, websites an Agent visits for you, or apps other customers publish, which have their own policies.

Where we are the controller

We decide how to use, and this policy explains our use of: account and sign-in data and your organization’s settings; billing, payment and Credits records; website, cookie and form data; support requests and the metadata of error and problem reports (such as the error description, app version, operating system and install ID); security, abuse-prevention and audit data; product telemetry, such as usage events, error events and update checks, and the identifiers, model, token counts and cost recorded for model requests that pass through our servers; and program and contest entries, invitations, and copyright and other legal notices.

Where we act for our Customers

Customer Content includes the records, files, apps and sites you build, the prompts and instructions you give Agents, Proto sessions sent to us (including the content of Proto model requests that pass through our servers, the transcripts in error reports, and the chat and logs in feedback and problem reports) and Outputs. It often contains personal data about other people, such as your customers or employees.

The Customer is the controller of that data and we are its processor (a “service provider” or “processor” under US state laws). We process it only to provide, bill, secure and support the Services and as the DPA allows, including, on our Customers’ instructions under the DPA, to secure the Services, prevent fraud, abuse and illegal content, and comply with law. We do not use it for our own marketing, give it to affiliates for their own purposes, or sell or share it.

If you use an app built or published on ERP•AI (for example a customer portal), or visit a site hosted on build.host, the business that runs it decides what it collects. Please contact that business first; we will help it respond. We also use build.host edge logs for our own purposes, as “Visitors to hosted sites” describes. If you use the Services for your own business, for example as a freelancer, you are the Customer.

The ERP•AI platform

When you use apps.erp.ai, we collect:

• Account data: your email address, a display name we derive from it, your password if you use one, your organization and role, and invitations you send or accept. Each new user gets a personal organization unless they join through an invitation or company single sign-on.
• Security data: sign-in events, sessions (which last up to 30 days), two-factor and passkey registrations, and audit logs that record the acting user’s email and IP address. If your organization requires phone verification, we collect your phone number and send a code through Twilio by SMS or WhatsApp.
• Usage Data: the operations you and your Agents run (such as reads, writes, exports, workflow runs and AI calls), their size and cost, and the Credits they use.
• Customer Content: records, files, attachments, schemas, workflows, apps, snapshots and exports. Files, snapshots and backups are stored in Cloudflare R2. Record exports (CSV, Excel and PDF) are created in an Amazon Web Services storage bucket in Singapore and delivered through Amazon CloudFront.
• Access logs: our servers log the IP address, browser user agent, referring page, address requested and result of requests to apps.erp.ai and www.erp.ai, which we analyze with our own in-house tool. We may derive your approximate country or region from your IP address using a database on our servers.

Videos your team embeds from YouTube, Vimeo or Loom, Excel and PowerPoint files shown through Microsoft’s Office viewer (which receives a link to the file and fetches it), and theme fonts from Google Fonts send viewers’ IP addresses to those services. We send account, security and workflow emails through Resend; a workflow alert you configure may include record data you chose to put in it.

Proto

Proto is a desktop app that runs on your computer and needs an ERP•AI account. This section describes Proto version 0.3.4, and we update it when these data flows change.

What stays on your computer

Proto stores the following in the ~/.proto folder, in its app data folder and in .proto folders in your workspaces:

• settings, including API keys you enter for Model Providers and ERP•AI, in plain-text files protected by your operating system’s file permissions;
• your ChatGPT sign-in tokens, if you use Codex mode or have used OpenAI’s Codex CLI (see below);
• chat transcripts, including screenshots and images, and Proto’s memory files;
• saved passwords, one-time-code secrets, passkeys and cookies for Proto’s built-in browser, encrypted with your operating system’s keychain, and cookies you import from another browser on your computer;
• logs, crash dumps and error reports waiting to be sent.

We cannot see this data unless Proto sends it to us as described below, and Proto does not back it up to us. To remove it, delete those folders.

Device permissions. Your operating system asks you before Proto can use protected features such as the camera, microphone, location or calendars. Proto’s built-in browser lets a website use your camera or location only after you allow that site, and that data goes to the website, not to us.

Codex CLI credentials. When Proto starts, in any mode, it checks whether OpenAI’s Codex CLI has saved sign-in tokens on your computer (in ~/.codex/auth.json). If Proto has no ChatGPT sign-in of its own, it copies those tokens into ~/.proto/codex-oauth.json and reads your Codex CLI model settings, even if you never choose Codex mode. The tokens stay on your computer, and Proto sends them only to OpenAI.

What Proto sends, and where

Proto’s crash reporter does not upload crash dumps, but some failures, such as an unclean exit, are sent as error events. When you download Proto from our websites, our download service logs your IP address, browser user agent and the download you chose. GitHub hosts the installer and update files.

What our servers keep and why

Model requests. For every model request that passes through our servers, including those made with your own OpenRouter or Fireworks key, we store your account, organization and session identifiers, the model, token counts and cost, the request content (in full up to 16 KiB, summarized above that) and the response (up to 64 KiB). We use the identifiers, model, token counts and cost to bill and attribute usage. To link a request to the right account, we may also use an email address found in the stored request, normally the account email Proto adds to each request; because that address comes from Customer Content, we use it only as our Customer’s processor, to measure usage for billing as the DPA allows. We keep the content, as our Customer’s processor, to troubleshoot Proto and, on our Customers’ instructions under the DPA, to secure the Services, prevent fraud, abuse and illegal content, and comply with law. Our servers use your provider key to call that provider and are not designed to store it.

Reports. We use error events and report metadata to detect and fix faults across Proto. We use the contents of error reports, feedback and problem reports only to find and fix the problem reported, support you and keep Proto secure, as our Customer’s processor, and authorized engineers may read them for those purposes. Reports can contain sensitive information and other people’s personal data, such as messages, file contents, web pages and tool results. Because error reports are sent automatically and cannot yet be turned off, do not use Proto for content you do not want sent to us.

Actions Proto takes. By default, Proto runs in Uninterrupted mode and can send messages, submit forms and share content with other services without asking you first. Data an Agent sends to another service is handled under that service’s terms. To review actions first, turn Uninterrupted mode off in Settings > Permissions.

Proto Browser Helper. This browser extension is not released. If we release it, it will communicate only with the Proto app on your computer, and page content it passes to Proto is handled as this section describes.

build.host

Account holders

You sign in to build.host with an email code from ERP•AI’s sign-in service, protected by a Cloudflare Turnstile check. We keep a record of your user ID, email, name and when you first and last signed in. If you connect from Proto with an ERP•AI key, build.host receives only your user and organization IDs.

We also store your projects, Hosted Content, uploaded source code (kept as version history so you can roll back), environment variables and secrets you set, build and runtime logs, custom domains, and API keys (stored only as a hash, with the last four characters, a label and dates). If you connect GitHub, we store the installation ID, and GitHub sends us details of pushes, including committers’ names and email addresses, which we use only to start deploys. Let’s Encrypt receives your domain names to issue certificates. Paid plans cannot be bought online today; if we offer online checkout, payment will run through Stripe, which will receive your email address and a billing reference.

Our staff can see account holders’ names and emails, projects and traffic in our operations console, and the start, stop, restart and redeploy actions they take there are logged with their identity. Some safeguards run automatically, as “Automated decisions” describes.

An earlier chat console on the build.host home page sent what visitors typed to OpenRouter, logged the first five messages of each session (shortened, with email addresses and sign-in codes removed) and kept signed-in users’ last 40 messages. The page no longer uses it, but we still hold those records. build.host pages load fonts from Google Fonts, which receives your IP address. build.host sets only cookies needed for sign-in and its console, and stores your theme choice in your browser.

Visitors to hosted sites

Every request to a build.host site, including on custom domains, passes through our servers, which log the time, site, page, status, size, response time, referring page, browser user agent and IP address. We use these logs to run and secure the service, prevent abuse and plan capacity. Traffic summaries we produce from them keep only counts and a shortened, salted hash of IP addresses (with the salt changed daily) and are kept for 90 days. These hashes are pseudonymous, not anonymous.

build.host adds a small script to every HTML page it serves. The script sets no cookies, stores nothing in the browser and sends no identifiers, events or page data. Where the site owner leaves it on, it shows a “Made with PROTO” badge. Every site uploaded from Proto also has a script tag in its index.html that loads the script from build.host itself through Cloudflare, so Cloudflare and build.host receive the site’s hostname and the visitor’s IP address. Our servers log the requests the script causes, with IP address and browser details, like any other request. Site owners can turn the badge off, but not the script.

We are the controller of our edge logs when we use them for these purposes. For the build and runtime logs a hosted app produces, and data visitors give a hosted site, we act for the site owner as its processor under the DPA. Site owners do not receive our edge logs or the IP hashes in our traffic summaries; on request, we include the hourly traffic counts for their own projects in an export, as the build.host Terms describe.

Abuse reports

If you report a site at build.host/report-abuse, we store the site address, category, the details you write, your email if you give it, the time and your IP address. The site address, category and your email are also written to our application logs. We use them to review the report, act against the site, prevent misuse of the form and meet legal duties. We may share a report with law enforcement or, where appropriate, with the site owner, but we will not give the site owner your email without your permission unless the law requires it. A report through this form is not a copyright notice; notices sent to our designated agent are shared as “Copyright, trademark and other legal notices” describes. If we become aware of apparent child sexual abuse material, we preserve it and report it to the National Center for Missing & Exploited Children as US law requires.

Our websites, forms and cookies

Our Cookie Policy lists the cookies and similar technologies we use. In summary:

• Essential storage records your cookie choice and keeps the sites working.
• Enhanced Features (optional) remembers preferences such as your theme.
• Performance & Analytics (optional; “Analytics Cookies” on proto.erp.ai) loads Google Tag Manager, Google Analytics and PostHog on www.erp.ai and on erpai.studio (our staging copy, which has no X Pixel), and Google Analytics and PostHog on proto.erp.ai. The hi.erp.ai form page loads Google Analytics only for visitors who open it in its own tab and allow analytics. These tools receive your IP address, device and browser details, pages viewed and interactions.
• Personalized Advertising (optional, www.erp.ai only) loads the X Pixel, which lets X measure visits and conversions from our ads and use your visit to choose ads it shows you on X. ERP•AI and X are jointly responsible for collecting this data and sending it to X, as the Cookie Policy explains.

On www.erp.ai and erpai.studio, optional categories start off until you turn them on. On protoagent.ai and proto.erp.ai, nothing optional is stored before you choose, but the Customize view starts with Enhanced Features switched on, so switch it off before saving if you do not want it. Until you allow analytics, Google’s consent mode tells Google tags that consent is denied, and the optional tools are not loaded. protoagent.ai uses no analytics, and build.host uses no analytics or advertising cookies.

Our Google Tag Manager container also holds a LinkedIn Insight Tag, an RB2B visitor-identification tag and a second PostHog tag. We do not use them: the way our sites load Tag Manager does not trigger them, and our sites’ security policy does not allow their scripts.

Contact and sales forms. Our contact page and Proto’s Contact sales dialog embed a Tally form at hi.erp.ai, and the Contact sales form on the ERP•AI platform’s Billing page sends what you enter, and the page you sent it from, to Tally. Tally receives what you enter (such as your name, work email, company and message), the page you came from and campaign codes. The form, or Tally’s script, can load with the page before you make a cookie choice, and it loads resources from Google Fonts, an error-monitoring service (Sentry) and GitHub-hosted files, which receive your IP address. Proto’s support form and Creator Partners application send your name, email and answers to an ERP•AI workflow app. Any marketing email we send where the law allows includes a way to unsubscribe, and you can also opt out at legal@erp.ai.

Other services. Our sites are delivered through Cloudflare, which may receive network error reports from your browser. Some pages show images from Unsplash, which receives your IP address. Our status page at status.erp.ai is run by Better Stack, which processes your email if you subscribe to updates.

Sign-in and payments

Sign-in. Depending on the Service, you can sign in with an email code, a password, a passkey, Google or your company’s single sign-on. With Google, we receive your name, email address, profile picture and Google account ID. With company single sign-on, your company’s identity provider sends us the attributes it is set up to send. The sign-up and sign-in screens on apps.erp.ai, in Proto and on build.host link to this policy.

Payments. We sell Credits through Stripe. Stripe collects your card or other payment details; we never see or store your full card number. We receive the payment result, a Stripe customer and payment method reference, your email address and the purchase details, and we keep a ledger of Credits granted, bought and used. If you turn on auto top-up, Stripe charges your saved payment method when your balance falls below the level you set. Stripe also uses your data under its own privacy policy, for example to prevent fraud.

Programs, contests and invitations

If you apply to the Proto Creator Partners program, join our partner or publisher programs, publish an app or enter a contest, we collect the details the application or rules ask for, such as your name, email, country, social profile and the content you submit. When you accept program terms, we record the version, time, IP address and browser user agent. For a contest on X, we collect your X handle and reply. If you win, we collect your legal name, country, contact, delivery and payment details, a signed eligibility declaration and the tax forms the law requires (such as IRS Form W-9 or W-8BEN, which include a taxpayer identification number). We use this data to run the program or contest, pay you, meet legal and tax duties and, where the rules allow, promote it. Prizes may be paid through banks, Wise or PayPal.

Referral credits (notice of financial incentive). If you invite someone to Proto and they sign up, we may give you Promotional Credits, in the amount and up to the limit Proto shows when you invite. The program uses the invitee’s email address and your account details. You join by sending an invitation, can stop at any time by sending no more, and can ask legal@erp.ai to stop crediting your account. We value the personal data involved at no more than the credit, based on what the credit costs us to provide.

If someone invited you. We got your email address from the person who invited you and use it only to send that invitation (and any reminder about it) and to credit that person if you sign up. To have the invitation deleted, email legal@erp.ai.

How we use AI and Model Providers

We do not use Customer Content, including your data, prompts, files, records, apps, Proto sessions, error reports and Outputs, to train or fine-tune AI models. We may use aggregated, de-identified metrics to operate, secure and improve the Services; we take reasonable measures to keep such data de-identified and will not try to re-identify it. We also use Usage Data, which does not include the content of Customer Content, to understand how the Services are used and to improve them.

To provide AI features, we send the content needed for each request to Model Providers:

• Platform AI. The in-app Agent and workflow features call models mainly through OpenRouter, with a pseudonymous user ID, and OpenRouter forwards each request to the company that hosts the selected model. For the in-app Agent, we use OpenRouter’s setting that excludes hosts that, as OpenRouter classifies them, store request data or use it for training. Proto Managed and some other platform features do not use that setting today, so OpenRouter may send those requests to hosts that keep request data or use it to improve their models. Some features call Anthropic directly (document and theme design, workflow AI mapping and the Claude workflow step), and some app-creation and spreadsheet-mapping features are built to call OpenAI directly.
• Voice features. Where Proto offers voice input or transcription, audio goes to a speech-to-text provider, either directly from your device with a short-lived token from our servers or through our servers.

Model Providers may keep inputs and outputs under their terms with us (or, for hosts reached through OpenRouter, with OpenRouter), for example to monitor for abuse, and the law may require them to keep data longer.

Your own keys and accounts. When you use your own API key, your organization’s saved OpenRouter key, or your ChatGPT account in Codex mode, your agreement with that provider governs how it handles your data, even where the request passes through our servers as the Proto section describes.

Automated decisions

Some security and abuse controls act automatically, before a person reviews them. We block sign-ups from disposable email domains. build.host refuses deploys that match phishing or wallet-draining patterns, can stop hosted sites and apps that show signs of phishing, cryptocurrency mining or sustained high CPU use (for accounts approved to run server-side code, mining and CPU signals go to human review instead), and can stop server-side apps when a paid plan lapses. These controls match set patterns, such as known disposable email domains, brand impersonation combined with password or payment forms, known mining programs, and CPU use above a set level for about 30 minutes. They are needed to provide a safe service under our contract with you.

If one affects you, you can ask a person to review it, give your point of view and contest the result by emailing legal@erp.ai with “Appeal” in the subject, as the Acceptable Use Policy and the build.host Terms describe, and we will tell you the outcome. We make no other decisions about you based solely on automated processing that have legal or similarly significant effects on you.

Why we use personal data and our lawful bases

Where the GDPR, the UK GDPR or similar laws apply, we rely on these lawful bases:

Reports may contain sensitive information about you or others. Where the law requires a separate basis for it, our Customer decides it for the contents of error reports, feedback and problem reports, as for other Customer Content; for the description you write in a problem report, we rely on your explicit consent when you choose to send it.

Your right to object. Where we rely on legitimate interests, you can object at any time by emailing legal@erp.ai, and we will stop unless we have compelling legitimate grounds or need the data for legal claims. You can always object to direct marketing. Proto sends error events and error reports automatically and has no setting yet to stop them; if you object, we will delete the error events we hold for your account and, with the agreement of the Customer that controls them (you, if you use Proto for your own business), the error reports, but to stop new ones you would need to stop using Proto. Where we rely on consent, you can withdraw it at any time: for cookies, through each site’s cookie settings (on www.erp.ai, the link in the footer); otherwise by contacting us. Withdrawal does not affect earlier processing.

You do not have to give us personal data, but we cannot create an account or provide most Services without an email address.

How we share personal data

Service providers and subprocessors

We use service providers that process personal data for us. The subprocessors that process Customer Content for our Customers, and the main providers for our websites, are listed with their purpose and location on our subprocessor list. Other recipients, such as Let’s Encrypt, Unsplash, Microsoft’s Office viewer, X and our prize-payment providers, are named in the relevant sections of this policy. The main providers are:

Affiliates

Our affiliates may help us provide the Services. They act for us, under our instructions and confidentiality duties, and may not use personal data or Customer Content for their own purposes. Some of the cloud and code-hosting accounts we use are held in the name of Deskera. We use them only to provide the Services, and we do not permit Deskera to use personal data or Customer Content in them for its own purposes.

Model Providers and services you connect

When you use AI features, we send request content to Model Providers as described above. When you or an Agent connect another service (such as Google Workspace, Slack, GitHub or a website), we send that service the data needed to do what you asked.

Your organization

If you use an account that belongs to an organization, its administrators can see your profile, your activity in its apps and audit logs, and can manage or remove your access.

Copyright, trademark and other legal notices

If you send a copyright notice or counter-notice, we collect its contents (including your name, address, telephone number, email and signature) and, for form reports, your IP address. As the Copyright Policy explains, we send a copy of a copyright notice, including the sender’s name and contact details, to the affected account holder, and a copy of a counter-notice, including the user’s contact details, to the person who sent the notice.

For trademark and other intellectual property complaints, we may give the affected account holder the complaint, including your name and contact details, so it can respond. For requests to remove intimate images shared without consent, we share your identity with the account holder only where strictly necessary to act on the request or where the law requires it.

Legal requests, safety and business transfers

We disclose personal data when we believe in good faith that the law requires it (for example a valid subpoena or court order), or that it is needed to protect someone’s safety, to investigate fraud, security incidents or abuse, or to enforce our terms.

For Customer Content, we disclose only when the law requires it, when we report apparent child sexual abuse material or other illegal content as the law requires or allows, or when we believe in good faith that disclosure is needed to prevent imminent harm to someone’s life or safety. When a public authority asks for Customer Content, we follow the DPA: we try to redirect the request to the Customer and tell the Customer promptly, unless the law prohibits it or notice would create a risk of harm or hinder an investigation.

If we are involved in a merger, acquisition, financing, reorganization or sale of assets, personal data may transfer to the other party, which must protect it as this policy describes. Customer Content transfers only subject to the DPA. We also share personal data when you ask us to or agree.

Sale, sharing and advertising choices

We do not sell personal data for money, and we do not sell or share Customer Content. If you switch on Personalized Advertising on www.erp.ai, the X Pixel loads and X receives your IP address, cookie identifiers and the pages you visit, which it may use under its own terms. California and some other states may treat this as a “sale”, as “sharing” for cross-context behavioral advertising, or as targeted advertising. It happens only if you switch the category on, and we do not knowingly sell or share the personal data of anyone under 16.

You can opt out at any time by switching Personalized Advertising off through the cookie settings link in the www.erp.ai footer, or by emailing legal@erp.ai.

Global Privacy Control. On www.erp.ai, erpai.studio, protoagent.ai and proto.erp.ai, we treat a Global Privacy Control (GPC) signal from your browser as your refusal of the optional advertising category for that browser.

Do Not Track. There is no common standard for Do Not Track signals, so we do not respond to them separately. We honor GPC as described above.

Other companies, such as Google and X, may collect information about your online activities over time and across websites when their tools load on our sites with your consent.

How long we keep personal data

We keep personal data only as long as we need it for the purposes in this policy. Where the table gives no fixed period, we decide by looking at how long the account or relationship lasts, what the law requires us to keep (for example tax records), how long we need the data to secure the Services, investigate problems and resolve disputes, and whether you have asked us to delete it. When we no longer need data, we delete or de-identify it. Automated deletion schedules are still being built, so some deletion is done by hand, and you can ask legal@erp.ai to delete data about you that we no longer need. Backups are overwritten on their own schedule, and we may keep data longer for a legal hold or investigation.

International transfers

Our servers are in the United States, in Hetzner data centers in Ashburn, Virginia and Hillsboro, Oregon. Cloudflare carries traffic on its global network and stores files, snapshots and backups in R2 in locations Cloudflare chooses. Record exports are created in an Amazon Web Services bucket in Singapore, where some files from an earlier version of the platform may also remain. Model Providers process requests where they run their models, and OpenRouter may send a request to a host in the United States or in another country. Our subprocessor list gives our providers’ locations.

If you are in the European Economic Area, the UK or Switzerland, your data is processed in the United States and other countries whose laws may differ from yours. Some of them, including Singapore, have no EU or UK adequacy decision, and the decisions for the United States cover only organizations certified under the EU-US Data Privacy Framework, which we are not. For personal data our Customers transfer to us, the DPA includes the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss amendments. For our own transfers to providers, we rely on the safeguards they offer, such as Standard Contractual Clauses in their data processing terms or their Data Privacy Framework certification, where available. You can ask for a copy of the relevant safeguards at legal@erp.ai.

Security

We protect personal data with measures that include HTTPS for our sites and APIs, separate identity and permission services with role-based access, optional two-factor authentication and passkeys, restricted staff access to administrative tools, audit logs, and hashed storage of build.host API keys. Proto encrypts its saved passwords and secrets with your operating system’s keychain, but stores Model Provider keys, ERP•AI API keys and ChatGPT tokens in plain-text files on your computer, so keep your device secure.

Some controls, such as automated deletion schedules, are still being built, and we do not claim any independent security certification. No system is perfectly secure. If a breach affects your personal data, we will notify you and regulators as the law requires. Report security issues to legal@erp.ai.

Your rights

EU, UK and Switzerland

You have the right to access your personal data and get a copy, correct it, delete it, restrict our use of it, receive it in a portable format (today through table exports and app snapshots, and on request for other data), object to processing based on legitimate interests (and to direct marketing at any time), withdraw consent, and not be subject to decisions based solely on automated processing that have legal or similarly significant effects. We respond within one month, which the law lets us extend by two more months for complex requests.

Complaints. Please tell us first at legal@erp.ai. If you are in the UK, we will acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the data protection authority where you live or work (the European Data Protection Board lists them at www.edpb.europa.eu), the UK data protection regulator (ico.org.uk), or the Swiss Federal Data Protection and Information Commissioner.

California

If you live in California, and to the extent the California Consumer Privacy Act applies to us, you have the right to know what personal data we have collected about you (its categories, sources, purposes and recipients) and get a copy; to delete and correct it; to opt out of its sale or sharing (see “Sale, sharing and advertising choices”); and not to be discriminated against for using these rights. Our referral program, which may be a financial incentive, is described under “Programs, contests and invitations”. We use sensitive personal information only for purposes the law allows, so the right to limit its use does not change how we use it. We confirm receipt within 10 business days and respond within 45 days, which we may extend by another 45 days if we tell you.

In the past 12 months we collected these categories of personal information:

We collect this data from you, your devices, your organization, people who invite you or send us notices, sign-in providers, Stripe, GitHub and X. We use it for the purposes in “Why we use personal data and our lawful bases” and keep each category as “How long we keep personal data” describes.

Other US states

Residents of states with comprehensive privacy laws (such as Colorado, Connecticut, Delaware, New Jersey, Oregon, Texas and Virginia) may have, where those laws apply to us, the right to confirm whether we process their data, to access, correct, delete and port it, and to opt out of targeted advertising, sale and profiling for significant decisions. We do not use personal data for profiling in furtherance of decisions with legal or similarly significant effects. The X Pixel described under “Sale, sharing and advertising choices” may be a sale or targeted advertising, and you can opt out as described there.

Appeals. If we decline your request, you can appeal by replying to our decision or emailing legal@erp.ai with “Appeal” in the subject. We will respond within the time your state’s law sets. If you are not satisfied, you can contact your state attorney general.

Other countries

Depending on where you live (for example Brazil, Canada, Australia, Singapore, Japan or India), you may have rights to access, correct, delete or port your data, to withdraw consent and to complain to your data protection authority. Email legal@erp.ai to use them; for Brazil, this address is our channel for data subjects and the ANPD.

How to make a request

Email legal@erp.ai and say what you are asking for. If you have an account, write from its email address. If you do not, tell us which service you used and how we can find your data (for example the email you gave in a form, the site you reported or your X handle). We verify requests by confirming control of the account email or by matching information we already hold, and we use any extra information we ask for only to verify you. You can use an authorized agent; we will ask for your signed permission and may ask you to confirm your identity with us directly. We do not charge for requests unless they are clearly unfounded or excessive.

Self-service deletion is not available yet; we carry out deletion requests manually. To close your account, contact care@erp.ai. If your request concerns Customer Content that a business controls, we will refer it to that business or help it respond.

Children

The Services are for business use by people 18 or older. They are not directed to children, and we do not knowingly collect personal data from anyone under 18. If we learn that someone under 18 has created an account, we will close it and delete their data. Contact legal@erp.ai if you believe a child has given us personal data.

Google Workspace data

In Proto, when you choose to connect a Google account through a Google Workspace plugin, ERP•AI asks for the Google Workspace permissions required by the plugins you enable. The Google consent screen shows the requested permissions before you approve them. Depending on the plugins and actions you enable, ERP•AI may access:

• Google Calendar, Drive, Docs and Sheets: calendars and event details, and file names, metadata and document or spreadsheet content available under the permission you approve. ERP•AI may create, update or delete events and create or update files, documents and spreadsheets at your request.
• Gmail messages, threads, drafts, labels and basic mail settings, only if a plugin you enable offers Gmail access, and may create drafts, send messages or update those items at your request.
• Google Workspace Directory user records, only if an organization administrator separately enables an administrator-only Directory plugin or action. Directory operations are limited by the administrator’s assigned Google Workspace role and follow Proto’s approval settings: Proto asks for approval before a Directory action only when Uninterrupted mode is off. In Uninterrupted mode, which is the default, they run without an approval prompt.

ERP•AI uses Google Workspace data only to confirm that a connection works and to perform the plugin actions you request, such as finding or summarizing permitted information, preparing or sending an email, managing an event, or creating and editing a file. We do not sell Google user data, use it for advertising, or use it to train or fine-tune any AI models, including generalized AI and machine-learning models. When an action needs AI processing, the minimum relevant content may be sent to the model service used for that task (for Proto Managed, through our servers, as the Proto section describes), under that provider’s terms or, if you use your own key or account, your agreement with that provider. Google Workspace data is not disclosed to another party except to complete an action you requested, with your consent, for security or abuse prevention, or when required by law. Human access is prohibited except with your explicit consent for support, for security or abuse investigation, when required by law, or when the data has been aggregated and anonymized. These limits also apply to Google data in our request logs and in Proto’s automatic error reports, which can include Google data from a session.

For Google accounts you connect through these plugins in the Proto desktop app, Google OAuth access and refresh tokens are stored locally on your device and are not synchronized to ERP•AI. Google data returned by a plugin may remain in local session or workspace files when needed to complete or preserve your requested work. If you deliberately save or transfer Google data to a hosted ERP•AI application, that copy becomes Customer Content, handled under our Data Processing Addendum and the retention settings for that application, and keeps these protections.

You can disconnect a Google account in Proto, remove the local plugin data, or revoke access from your Google Account permissions. Disconnecting removes the locally stored Google OAuth tokens. Local session, workspace or exported files remain until you delete them. For help with access or deletion, contact care@erp.ai, or make a privacy request at legal@erp.ai.

ERP•AI’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Changes to this policy

We post updates here with a new “Last updated” date and keep earlier versions available on request. If a change materially reduces your rights or lets us use existing data in a new way, we will tell you at least 30 days in advance by email or in the product, and ask for your consent where the law requires. We will not use personal data or Customer Content we already hold for a materially different purpose, including training AI models, without your consent.

Contact us

ERP•AI US Inc., 2 Embarcadero Center, San Francisco, CA 94111, USA. Email legal@erp.ai for privacy questions and requests.