Privacy Policy
1. Controller
The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:
Sandro Ieva
Arnimstrasse 13
23566 Lübeck
Germany
Email: support@i7os.com
2. Scope
This Privacy Policy applies to the i7OS web application (the “Service”), available at app.i7os.com and its subdomains. It explains which personal data we process, why we process it, and which rights you have.
3. Definitions
Terms used in this Privacy Policy have the meanings set out in Article 4 GDPR. “Personal data” means any information relating to an identified or identifiable natural person.
4. Data we process
4.1 Account data
When you register through Google OAuth, we process:
- Your first and last name
- Your email address
- Your profile picture, if one is stored with Google
- A unique user ID
4.2 Content you create
We store content that you create or upload in the Service, including workspace and project information, chat messages, tasks, notes, brand profiles, names, logos, colours, descriptions, files, personas, strategy notes and channel connections.
4.3 Google integration data
If you grant i7OS access to your Google account, we process data through the permissions you approve:
auth/calendar.events: reading, creating, changing and deleting events in your primary Google Calendar, only when you actively request the relevant action.auth/drive.file: access to files created by i7OS or explicitly shared with i7OS. The Service cannot access other files in your Drive.
When you actively import a Google Drive file into your assets, a copy of that file is stored in our Supabase storage in the EU region so that it remains available in the Service. Otherwise, we store only references to your Google content, such as file or event IDs, rather than its full content.
4.4 Technical data
We may process your IP address during a session, access timestamps, browser and device information, encrypted authentication tokens, and push-notification endpoints if you enable notifications. IP addresses are not permanently stored by i7OS.
4.5 Cookies and local storage
We use technically necessary cookies and browser local storage for authentication, language and theme preferences, and application state. We do not use tracking, analytics or advertising cookies.
5. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Service | Article 6(1)(b) GDPR — performance of a contract |
| Google integrations | Article 6(1)(a) GDPR — consent through OAuth |
| Transactional emails | Article 6(1)(b) GDPR — performance of a contract |
| Push notifications | Article 6(1)(a) GDPR — consent |
| Security and abuse prevention | Article 6(1)(f) GDPR — legitimate interests |
| Use of processors | Article 28 GDPR |
6. Recipients and processors
6.1 Supabase — database and storage
Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992. Our data region is the EU (Frankfurt, Germany). A data processing agreement is in place. Supabase Privacy Policy.
6.2 Vercel — hosting
Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Transfers are protected through appropriate safeguards such as EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Vercel Privacy Policy.
6.3 Resend — transactional email
Resend, Inc., 2261 Market Street #4391, San Francisco, CA 94114, USA. Transfers are protected through EU Standard Contractual Clauses. Resend Privacy Policy.
6.4 Google — OAuth and APIs
For users in the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes login information, calendar events and Drive file metadata only in connection with actions you request. Google Privacy Policy.
i7OS complies with the Google API Services User Data Policy, including its Limited Use requirements.
6.5 AI providers
When you use AI features, the relevant request may be sent to one of the following providers:
- Anthropic (Claude): Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA
- OpenAI (GPT): OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland
- Google (Gemini): see section 6.4
Requests are transmitted to provide the requested response. Under the applicable API terms, API data is not used to train general-purpose models.
7. International transfers
Some processors may process data outside the European Economic Area. Where required, transfers rely on EU Standard Contractual Clauses, the EU–US Data Privacy Framework where the recipient is certified, and additional technical safeguards such as encryption in transit and at rest.
8. Retention
| Data category | Retention period |
|---|---|
| Account data | For as long as your account remains active |
| Content data | For as long as your account remains active |
| Authentication tokens | Up to seven days; deleted when you log out |
| Technical logs | 30 days |
| Data following account deletion | 30-day recovery period, followed by permanent deletion |
If you expressly request deletion at support@i7os.com, we will delete your data immediately and irreversibly in accordance with Article 17 GDPR, unless a legal retention obligation applies.
9. Push notifications
If you enable push notifications, we store your browser or device push endpoint to send transactional messages such as mentions, reminders and project invitations. We do not send marketing push notifications. You can withdraw your permission at any time in your browser or application settings.
10. Security
We use technical and organisational measures appropriate to the risk in accordance with Article 32 GDPR, including:
- TLS/HTTPS encryption for data in transit
- Encryption of stored database data
- Row-level security so that users can access only their own or shared data
- Access controls through established OAuth providers
- Minimal permissions such as
drive.fileandcalendar.events - Regular backups
11. Your rights
Subject to the applicable requirements, you have the right to access your data (Article 15 GDPR), rectify inaccurate data (Article 16), request erasure (Article 17), restrict processing (Article 18), receive portable data (Article 20), object to processing (Article 21), withdraw consent at any time (Article 7(3)), and lodge a complaint with a supervisory authority (Article 77).
Our competent supervisory authority is the Independent State Centre for Data Protection Schleswig-Holstein (ULD). Send requests to support@i7os.com. We generally respond within one month.
12. Changes to this Privacy Policy
We may update this Privacy Policy when features or legal requirements change. We will communicate material changes with reasonable notice by email or within the Service.