Effective Date: January 8, 2026  ·  Last Updated: September 16, 2026

Privacy Policy

Action (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our workspace collaboration platform and related services — including our built-in AI features, which process workspace content through third-party AI providers as described below, and our API integrations with AI assistants like ChatGPT and Claude.

By using Action, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Information You Provide Directly

When you use Action, you may provide us with:

• Account Information: Name, email address, profile picture, and authentication credentials when you create an account (a password, if you sign up with email rather than Google or Microsoft); additional email addresses you choose to verify; phone number if you enable SMS notifications
• Workspace Content: Tasks, posts, decisions, metrics, channels, and other content you create within your workspaces
• Communication Data: Comments, votes, and interactions with other workspace members
• Integration Settings: Configuration data and credentials for the services you connect (messaging, project tools, CRM, and others listed below) and API keys you issue

Information Collected Automatically

When you access Action, we automatically collect:

• Usage Data: Pages visited, features used, actions taken, and timestamps
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP addresses, access times, error logs, and referring URLs
• API Access Logs: Operations performed via the MCP and REST APIs, including timestamps and response codes

Information from Third-Party Integrations

When you (or a workspace admin) connect Action to third-party services, we receive data from those services as authorized during the connection flow. Depending on which integrations your workspace enables, this may include:

• Messaging (Slack, Telegram): Workspace and channel information, user identifiers, and messages in channels you connect
• Work Tools (Linear, Jira, Asana, monday.com, GitHub, Attio, BambooHR, Stripe, Freshdesk, Google Analytics for your own properties): Projects, issues, records, tickets, and activity data from the tools you connect, used to compute status and insights — for Stripe, this includes subscription and revenue data and associated customer names and email addresses; for Freshdesk, support tickets and the customer details they carry; for Google Analytics, aggregated traffic and acquisition figures for your properties
• Directory Providers (Google Workspace, Microsoft 365, Slack): Names, email addresses, and basic profile information of members of your organization, when directory sync is enabled
• Email: Messages sent to your workspace's Action email address, including sender information and attachments
• Meetings and voice captures: Audio captured during meeting capture sessions or voice captures you start, and the resulting transcripts and notes — you are responsible for notifying participants and obtaining any consents required by law before starting a capture
• AI Assistants (ChatGPT, Claude, Cursor): API requests and operation parameters sent through our MCP server
• Authentication Providers: Basic profile information from OAuth providers (Google, Microsoft, etc.)

How We Use Your Information

Provide and Improve Our Services

• Operate and maintain the Action platform
• Process and fulfill your requests (creating tasks, posting updates, etc.)
• Enable collaboration features within your workspaces
• Personalize your experience and provide relevant content

Provide AI Features

Action includes built-in AI features: summaries and highlights, morning briefings, extraction of tasks and decisions from meetings and messages, natural-language parsing, insights computed from connected tools, and conversations with the Action agent (in the app or over Slack, Telegram, email, or SMS). To provide these features, relevant workspace content is sent to our AI service providers for processing:

• Language models (Anthropic): Workspace content relevant to the feature (for example, the updates being summarized, or a meeting transcript being turned into notes) is sent to Anthropic's API to generate the output
• Text embeddings (OpenAI): Workspace text and search queries are sent to OpenAI's embeddings API to power search and semantic matching
• Speech-to-text (Deepgram): Audio from meeting capture and voice capture sessions you start is streamed to Deepgram solely to produce a transcript; we do not store the audio

No training: We do not use your data to train AI models, and we do not grant our AI service providers permission to do so. Data we submit to Anthropic and OpenAI is processed under commercial API terms under which the provider does not use it to train models. Providers may retain submitted data for a limited period under their published data-retention policies (for example, for abuse monitoring).

Enable AI Assistant Integration, API Access, and Automations

• Process requests from connected AI assistants (ChatGPT, Claude, Cursor)
• Execute MCP API operations on your behalf
• Serve requests made with your API keys to our REST API, including from automation tools such as Zapier
• Maintain API access logs for security and debugging

Communication

• Send transactional emails (task assignments, decision notifications)
• Deliver email digests summarizing workspace activity
• Deliver notifications and reminders over the channels you enable — Slack, Telegram, SMS, and browser push
• Serve your open tasks with a due date to your calendar application, if you subscribe to your personal calendar feed (a private link only you hold)
• Notify you of important account or service updates
• Respond to your support requests

Security and Compliance

• Detect, prevent, and address fraud, abuse, or security issues
• Enforce our Terms of Service and other policies
• Comply with legal obligations

Analytics and Improvements

• Analyze usage patterns to improve our services
• Develop new features and functionality
• Monitor and improve performance and reliability

How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

Within Your Workspace

• Workspace content (tasks, posts, decisions) is visible to workspace members based on channel membership and permissions
• Your profile information (name, avatar) is visible to other members of workspaces you belong to

With Service Providers

We work with third-party service providers who assist us in operating our platform:

We engage these providers under terms that require them to protect your information and restrict their use of it to providing their services (including limited purposes set out in their own terms, such as abuse monitoring).

With AI Service Providers (Built-in AI Features)

As described under “Provide AI Features” above, Action's built-in AI features send relevant workspace content to Anthropic (language models) and OpenAI (embeddings), and meeting and voice capture audio to Deepgram (transcription). This processing is subject to our no-training commitment: we do not use your data to train AI models and do not grant these providers permission to do so. Submitted data is used to generate the requested output, subject to the provider's data-retention policy.

With AI Assistants You Connect

Separately, you can connect external AI assistants (ChatGPT, Claude, Cursor, and similar tools) to your workspace through our MCP API. When you do:

• Requests: The assistant sends requests to our API on your behalf, and the content it requests (task lists, post details, search results) is returned into that assistant's conversation context
• Their terms govern: Once data is returned to an assistant, its handling — including retention and any model-training settings — is governed by your own agreement and settings with that assistant's provider, not by this policy. Review your assistant's data controls before connecting it to sensitive workspaces
• API Keys: Your Action API key authenticates requests and is never shared with the assistant provider beyond the connection you configure

With Third-Party Tools You Connect

When you connect integrations (Slack, Telegram, Linear, Jira, Asana, monday.com, GitHub, Attio, BambooHR, Stripe, Freshdesk, Google Analytics, Zapier, Google Workspace, Microsoft 365, and similar), we exchange data with those services as needed to operate the integration you authorized — for example, reading activity to compute status, or sending notifications into a channel. Each provider's own privacy policy governs its processing of that data. You can disconnect an integration at any time in workspace settings.

Legal Requirements

We may disclose your information if required by law or if we believe disclosure is necessary to:

• Comply with legal processes or government requests
• Protect our rights, privacy, safety, or property
• Prevent fraud or abuse of our services

Business Transfers

If Action is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Data Retention

We retain your information for as long as necessary to provide our services and fulfill the purposes described in this policy:

• Account Data: Retained while your account is active; deleted upon account deletion
• Workspace Content: Retained while the workspace exists; deleted when the workspace is deleted
• API Logs: Retained for 90 days for security and debugging purposes
• Email Delivery Logs: Retained by our email delivery provider for a limited period under its retention policy
• AI Processing Data: We submit content to our AI service providers under terms that prohibit its use for model training and limit retention to the provider's published data-retention window

You can request deletion of your data by contacting us at privacy@action.app.

Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption: All data is encrypted in transit (TLS 1.2 or higher) and at rest
• Access Control: Row-level security ensures users can only access data they're authorized to view
• API Security: API keys are securely hashed; rate limiting prevents abuse
• Authentication: Sign-in via Google or Microsoft OAuth, or with an email address and password. Passwords are held only as salted hashes by our authentication provider (Supabase Auth); we never see or store them in plain text. For OAuth sign-ins, multi-factor authentication is inherited from your identity provider; we do not currently offer multi-factor authentication for email and password accounts
• Monitoring: Security logging and audit trails

Despite these measures, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

Your Rights and Choices

Access and Portability

You can access your data at any time through the Action interface. Contact us to request a copy of your data in a portable format.

Correction

You can update your profile information and workspace content directly within Action.

Deletion

You can delete:

• Individual items (tasks, posts, etc.) within the application
• Your workspace, through workspace settings (workspace owners only)
• Your account, by emailing privacy@action.app — we complete account deletion requests within 30 days

API Access Control

You can:

• Enable or disable MCP API access for your workspace
• Toggle read and write operations independently
• Issue API keys with granular scopes (e.g., read-only metrics)
• Revoke connected apps and API keys at any time
• Review an audit log of all API operations

Notification Preferences

You can manage notification and email preferences in your account settings — which events reach you, over which channels, and how promptly (three presets: Quiet, Balanced, and Responsive) — and adjust them with one click from any notification email we send, without signing in.

Do Not Track

Action does not currently respond to “Do Not Track” browser signals.

Cookies and Tracking Technologies

Action uses the following cookies and similar technologies:

• Essential Cookies: Authentication and session cookies required to keep you signed in and secure the service. These cannot be disabled
• Analytics: PostHog (usage events and session replay, as described above) and Google Analytics (page views and usage measurement) set identifiers to understand how the product is used
• Attribution: A first-touch cookie records how you originally arrived at Action (e.g., campaign parameters)

We do not use third-party advertising cookies. You can limit or clear cookies through your browser settings; blocking essential cookies will prevent sign-in.

International Data Transfers

Action is hosted in the European Union. Our application runs on Vercel in Frankfurt, Germany, and your data — database, authentication, and file storage — is stored on Supabase in Paris, France (AWS eu-west-3). Product analytics (PostHog) are processed in the EU.

Some of our service providers process data in the United States: Anthropic and OpenAI (AI processing), Deepgram (transcription), Postmark (email), Twilio (SMS), Google (Google Analytics), and Vercel (request logs and technical telemetry). Where your personal data is transferred outside the European Economic Area, we rely on those providers' data processing terms, which incorporate the European Commission's Standard Contractual Clauses, and on the EU-U.S. Data Privacy Framework where the provider is certified under it.

Children's Privacy

Action is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn that we have collected information from a child under 16, we will delete that information promptly.

Third-Party Links and Services

Action may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Updating the “Last Updated” date at the top of this policy
• Sending an email notification for significant changes

Your continued use of Action after any changes indicates your acceptance of the updated policy.

Additional Information for AI Assistant Users

ChatGPT and Claude Integration

When you connect Action to AI assistants:

1. Authentication: You authorize access via OAuth or an API key scoped to your workspace
2. Data Flow: Your requests go from the AI assistant → Action API → your workspace data → back to the AI assistant
3. No Training by Us: We do not use your workspace data to train AI models. However, once data is returned into an AI assistant you connect, its handling — including any training settings — is governed by your agreement with that assistant's provider; review the assistant's data controls
4. Scope Control: You control which operations (read/write) the API can perform, and access is limited to what your own account can see

API Data Minimization

Our API follows data minimization principles:

• Only requested data is returned
• Rate limits prevent bulk data extraction
• All access is logged for audit purposes

Revoking Access

To disconnect an AI assistant:

1. To revoke an assistant you connected, go to Account → Apps & Integrations and revoke the connected app
2. Workspace admins can additionally revoke API keys or disable MCP access for the whole workspace under Workspace Settings → Integrations
3. Revoked credentials immediately stop working

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

• Email: privacy@action.app
• Support: support@action.app

For data protection inquiries or to exercise your rights, email privacy@action.app with the subject line “Privacy Request.”