Privacy Policy

1. Introduction

HQ by Indigo AI ("HQ," "we," "us," or "our") provides an AI-powered operating system that helps teams build, deploy, and orchestrate AI workers and workflows. This Privacy Policy describes how we collect, use, share, and protect your information when you use our website, desktop application, command-line tools, API integrations, and related services (collectively, the "Service").

By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

Account Information

• Name, email address, and profile details provided during registration
• Authentication credentials managed through our identity provider
• Account preferences and settings
• Subscription and billing information

Meeting Data

• Meeting recordings and audio files
• Meeting transcripts generated from recordings
• Meeting metadata, including title, description, date, time, duration, and URL
• Participant information, including names, email addresses, and roles
• Calendar event details from connected calendar accounts

AI-Extracted Signals

• Decisions, action items, accomplishments, and key facts identified from your meetings
• Direct quotes and citations attributed to meeting participants
• Speaker attribution and contextual information
• Relationships between people, teams, projects, and initiatives referenced in meetings

Chat & Interaction Data

• Messages and queries submitted through our conversational AI features
• AI-generated responses and insights provided to you

Usage & Technical Data

• Device information, browser type, and operating system
• Log data, including access times and pages viewed
• Product usage patterns and feature interactions
• Error reports and performance data

Payment Information

Billing details are collected and processed by our payment processor, Stripe. We do not directly store your full credit card number.

3. How We Collect Information

• Directly from you when you create an account, configure settings, or interact with the Service
• Automatically when our meeting bot joins your meetings to record and transcribe, or when you use the Service
• From third-party integrations you connect, such as Google Calendar, Slack, Zoom, or email
• From AI processing when our models analyze your meeting content to extract signals and insights
• Automatically on our website through cookies, pixels, and similar technologies, as described in Section 8 and our cookie notice
• From advertising platforms when you submit a lead form inside an ad, such as a Meta (Facebook or Instagram) lead form. We receive the answers you give in the form (for example name, work email, role, and team size) and which ad, ad set, campaign, and form you used
• From data enrichment providers, which may add business details such as job title, seniority, company name, and company size to a work email address you give us

4. How We Use Your Information

We use the information we collect to:

• Record, transcribe, and analyze your meetings
• Extract actionable signals such as decisions, action items, and key facts
• Provide AI-powered insights and conversational features
• Maintain and improve the Service's functionality and performance
• Manage your account, process payments, and communicate with you about the Service
• Send transactional emails related to your account or activity
• Monitor for errors, security issues, and abuse
• Comply with legal obligations

5. AI & Automated Processing

HQ uses large language models and other AI technologies to process your meeting recordings, transcripts, data from apps you connect, and related data. This processing is used to:

• Generate transcripts from audio recordings
• Extract signals (decisions, actions, accomplishments, key facts) from meeting content
• Provide conversational AI features and meeting summaries
• Let HQ agents answer questions and carry out tasks you ask for using the apps you connect
• Build and maintain a taxonomy of people, teams, projects, and initiatives referenced across your meetings

Your data is used for per-user inference only. We do not use your meeting content, transcripts, extracted signals, or connected-app data to train or fine-tune AI models. Your data is processed solely to deliver insights back to you and your organization.

6. Google User Data Access and Usage

HQ agents process Google user data. When a person connects Google and asks an HQ agent to use a Google capability, the agent reads the Google data needed for that request (for example matching mail threads, a named file, document, or spreadsheet range, calendar events, or a contact's name and email), uses it to answer or carry out the request, and returns the result to that person. HQ processes this data with the large language model providers named under "AI Processing of Google Data" below.

HQ connects to Google Workspace through HQ Integrations. A company admin chooses which Google capabilities to turn on, one at a time, and HQ asks Google only for the scopes that capability needs. Before Google's consent screen opens, HQ shows what data the capability reads, how agents use it, who receives it, how long it is kept, and how to delete it and revoke access. HQ agents then use a capability only when a person asks them to, and only through a company connection and agent grant that an admin has allowed.

Every change to Google data is previewed and confirmed first. Before an agent sends mail, changes labels or filters, changes existing messages, or creates, moves, or deletes a calendar event, HQ shows a preview of the exact change and the person must confirm it. HQ records a redacted audit entry for each change with the actor, tool, time, resource ID, and outcome. The audit entry does not contain message text, file content, or event details.

Below is the complete list of Google OAuth scopes HQ requests, grouped by Google's classification.

Restricted Scopes

• Gmail — Read-Only (gmail.readonly) – To search mail and open the matching threads a person asks an agent to review.
• Gmail — Modify (gmail.modify) – To mark existing messages read or unread, archive them, or add and remove labels on them, after the person confirms the change. HQ never permanently deletes mail.
• Gmail — Basic Settings (gmail.settings.basic) – To list, create, and delete Gmail filters that route future mail, after the person confirms the exact filter criteria and actions. No other Gmail settings are read or changed.
• Google Drive — Read-Only (drive.readonly) – To read the content of a specific Drive file the person selects. Reads are size-limited and HQ does not store the file content.
• Google Drive — Metadata Read-Only (drive.metadata.readonly) – To search Drive file names, types, sizes, and modified dates without opening file content.

Sensitive Scopes

• Gmail — Send (gmail.send) – To send a message the person has reviewed, with its recipients, subject, and body shown before they confirm.
• Google Docs — Read-Only (documents.readonly) – To read the text of a Google Doc the person names.
• Google Sheets — Read-Only (spreadsheets.readonly) – To read the cell values in a spreadsheet range the person names.
• Google Calendar — Calendar List Read-Only (calendar.calendarlist.readonly) – To list the calendars the person is subscribed to.
• Google Calendar Events — Read-Only (calendar.events.readonly) – To read event details such as title, time, attendees, and conferencing links, for answering questions about a schedule and for the meeting assistant.
• Google Calendar — Read-Only (calendar.readonly) – To read the person's calendars and event details, including attendees, times, and conferencing links, so the meeting assistant can join the right meetings and agents can answer questions about a schedule. Calendar connections made before HQ moved to the two narrower calendar scopes above hold this scope. HQ uses it only for these reads.
• Google Calendar Events (calendar.events) – To create, move, or delete an event after the person confirms a preview showing the calendar, title, time and time zone, attendees, and whether Google will email attendees. Attendees are emailed only if the person chooses that.
• Google Calendar — Free/Busy (calendar.freebusy) – To read when the person is busy or free so HQ Booking can offer meeting times that do not clash. HQ reads busy and free blocks only; it does not read event details with this scope. Requested only by the HQ Booking feature.
• Google Contacts — Read-Only (contacts.readonly) – To find a contact's name and email address.

Non-Sensitive Scopes

• Gmail Labels (gmail.labels) – To list label names and, after confirmation, create or delete labels.
• Google Drive — Selected Files (drive.file) – To open only the Drive files a person picks in Google's file picker. It gives HQ no access to any other Drive file.
• OpenID Connect (openid) – To confirm which Google account is being connected.
• Email Address (userinfo.email) – To show which Google account is connected and to bind the connection to it.
• Basic Profile (userinfo.profile) – To show the connected account's name in HQ.

AI Processing of Google Data

When a person asks an HQ agent to use a Google capability, HQ sends the Google data needed for that request to the agent's AI provider so the agent can answer or carry out the request. Which terms apply depends on whose AI account the agent uses.

• When the agent uses an AI account that HQ provides, the provider is Anthropic (Claude models), OpenAI (GPT and Codex models), or xAI (Grok models). These are the only large language model providers HQ uses to process Google user data. Our business agreements with these providers do not allow them to use the data to train their models. They may keep request data for a limited time, generally up to 30 days, for abuse and safety monitoring, and longer when a request is flagged for a policy violation or the law requires it, as their terms describe.
• When the agent uses an AI account that you or your company connect, including an agent hosted by HQ that is signed in with your own AI account such as a ChatGPT, Claude, or Grok account, the data goes to that provider at your direction, under that account's terms. Business and enterprise AI plans generally do not train on your data, but some personal AI plans let the provider use conversations to train its models unless you turn that off. Check your AI provider's data settings before you connect Google.

We do not use Google user data to develop, improve, or train generalized or non-personalized AI or machine learning models, and we do not allow the AI providers we contract with to do so.

Google API Services Limited Use Disclosure

HQ's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The following commitments apply to all Google user data accessed through any of the scopes listed above:

• We use Google user data only to provide or improve the user-facing features of HQ that are visible in our interface and that a person has chosen to use. We do not use it for any other purpose.
• We transfer Google user data to others only as needed to provide or improve those features (including to the AI providers named above), for security purposes such as investigating abuse, to comply with applicable law, or as part of a merger, acquisition, or sale of assets only after obtaining your explicit prior consent. All such transfers stay subject to these Limited Use restrictions.
• We do not sell Google user data. We do not use or transfer it for serving advertisements, including personalized, retargeted, or interest-based advertisements, and we do not transfer it to advertising platforms, data brokers, or information resellers.
• We do not use Google user data, or transfer it to anyone, to develop, improve, or train generalized or non-personalized AI or machine learning models.
• We do not use or transfer Google user data to determine credit-worthiness or for lending purposes.
• No person at Indigo AI reads Google user data unless the user gives us explicit permission for specific messages, files, or other data; it is needed for security purposes such as investigating abuse; it is needed to comply with applicable law; or the data has been aggregated and anonymized for internal operations.

You can remove a capability or the whole connection at any time. Disconnect Google in HQ Integrations to stop the company's access and delete the stored credentials. If the company connection uses your personal Google connection, also disconnect it in Personal Integrations to delete that credential. You can also revoke HQ's access in your Google Account permissions settings.

7. QuickBooks (Intuit) Data Access and Usage

If you connect your QuickBooks Online account, HQ accesses your QuickBooks data only with your explicit authorization and only to mirror your accounting records into your HQ workspace. We request Intuit's Accounting scope (com.intuit.quickbooks.accounting), and our access is read-only: HQ never creates, edits, deletes, or moves any data in your QuickBooks company, and we do not initiate payments or any money movement.

What We Access

With your authorization, HQ reads the following from your connected QuickBooks company:

• Your chart of accounts.
• Your invoices (accounts receivable) and bills (accounts payable).
• Your financial reports — Profit and Loss, Balance Sheet, and Cash Flow.

How We Store It

Your QuickBooks access and refresh tokens are stored encrypted at rest in a per-company vault (AWS Secrets Manager / SSM SecureString, KMS-encrypted) and are never stored alongside your accounting data, never logged, and never displayed. The accounting records we mirror are stored encrypted at rest within your own organization's isolated tenant and are accessible only to authorized users in your organization.

How to Disconnect and Revoke

You can disconnect QuickBooks at any time using the Disconnect control on your company's integrations page in your HQ console. Disconnecting revokes HQ's tokens with Intuit and deletes the stored token material from your company vault. You may also revoke HQ's access directly from within QuickBooks Online (Settings → Manage your Intuit account → connected apps) at any time.

We Do Not Sell or Share Your QuickBooks Data

HQ does not sell your QuickBooks data, does not use it for advertising, and does not use it for credit-scoring, lending, or any creditworthiness assessment. We do not transfer your QuickBooks data to third parties except as necessary to provide the features you have enabled, to comply with applicable law, or with your explicit, informed consent — and any such transfer remains subject to these same restrictions.

8. Information Sharing & Third-Party Services

We do not sell your personal information for money. We do share limited website and lead information with advertising partners, described below under Advertising and Analytics. Some US state privacy laws, including California's, treat that as a "sale" or "sharing" of personal information, and you can opt out of it at any time (Section 12). We share information only in the following circumstances:

Service Providers (Sub-Processors)

We use third-party service providers to operate the Service. These providers process data on our behalf under contractual obligations to protect your information:

The current list of sub-processors, including each provider's purpose and processing region, is maintained at hqforwork.com/subprocessors. That page is the authoritative list and is updated when a provider is added or removed.

Advertising and Analytics

We advertise HQ on Meta (Facebook and Instagram) and measure which ads lead to visits, sign-ups, sales requests, and booked calls. To do that we use the following on our website:

• Meta Pixel: a script from Meta that records page views, sign-ups, and booked calls on our website, and sets Meta cookies (such as _fbp and _fbc) in your browser. It also loads on two pages where you enter details, and there it reports one thing only: on the sign-up page, that you finished signing up, and on the call-booking page, that you booked a call. On those two pages it records no page view and its automatic tracking is off, so it does not read what you type, and the event it sends contains no name, email address, company, or booking details. It does not run on any other page where you enter account, payment, or form details.
• Meta Conversions API: our servers report when you submit a form on our website (such as a demo request or assessment), create an HQ company, open or finish setting up the desktop app, generate your first Daily Brief, reach two active members in a company, start a trial, or pay an invoice. Each event can include: your email address in hashed (SHA-256) form; for company events, a hashed company identifier; the Meta ad-click and browser identifiers (_fbc and _fbp, or an ad-click ID we stored from your first visit); your IP address and browser user agent; your country in hashed form; the address of the page the event came from; the event type, and for form events the form name; and a predicted or invoiced amount. We do not send your name, job title, or company name in plain text.
• Meta lead forms: if you fill in a lead form inside a Meta ad, Meta sends us your answers and the ad you used. We store them, email you about booking a call, and send Meta a confirmation of the lead with the same hashed identifiers and estimated value.
• VYG customer data platform: a script and server connection from VYG that records pages viewed, buttons clicked, sign-up steps, and the campaign and ad that brought you to us (UTM parameters and ad click IDs such as fbclid). When you sign in or give us your email address, VYG links that activity to your email. VYG processes this data on our behalf.
• Google Ads: a script that measures conversions from Google ads.
• Data enrichment: when you give us a work email address, we may ask an enrichment provider for public business details about you and your company (such as job title, seniority, and company size). We use them to decide who to follow up with and to estimate the value of a lead. We do not send these details to Meta; only the hashed identifiers and the estimated value described above.

Your choice depends on where you are. If you are in the United States, these tools are on by default and you can turn them off at any time (see Opting Out below). If you are anywhere else, including the European Economic Area, the United Kingdom, and Switzerland, they stay off until you choose Accept in our cookie banner, and you can change your choice in cookie settings. We work out your region from your IP address and keep only whether you are in an opt-out region.

Opting Out of Sale or Sharing

You can opt out with the "Do not sell or share my personal information" link in our website footer, on our cookie notice, or here: Do not sell or share my personal information. We also honor Global Privacy Control: if your browser sends that signal, we treat it as an opt-out without you clicking anything. Once you opt out in a browser, that browser stops loading the Meta Pixel, the VYG script, and Google Ads, the Meta cookies are deleted, our servers stop sending your website activity to Meta, and we do not send your details for enrichment from that browser. The opt-out is stored in that browser, so repeat it on each browser or device you use, or email us (Section 16) to opt out for your email address everywhere. Our website checks your choice before it sends anything to Meta. Our servers do not check consent again for events about a company, trial, or payment that they matched to an earlier visit made while tracking was on, so those can still be sent after you opt out. Meta uses these events to measure and improve our ads. To ask us about this processing, email privacy@hqforwork.com.

Other Disclosures

We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of HQ, our users, or the public.

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change. Google user data is transferred in such a transaction only after obtaining your explicit prior consent, as described in Section 6.

9. Data Storage & Security

We implement technical and organizational measures to protect your information, including:

• Encryption at rest and in transit for stored data and network communications
• Secrets you store in HQ, such as API keys and credentials, kept as encrypted SecureString parameters in AWS Systems Manager Parameter Store
• OAuth tokens for connected apps stored as vault objects in Amazon S3, encrypted with the vault's key
• Vault files in Amazon S3 encrypted at rest with AWS KMS keys. Each new vault gets its own key; some older vaults use a shared key or Amazon S3-managed encryption
• AES-256-GCM encryption for access and share tokens
• Multi-tenant data isolation ensuring that your data is accessible only to authorized users within your organization, enforced automatically at the query layer
• Webhook signature verification for third-party integrations

Meeting recordings and files are stored in encrypted cloud storage (AWS S3). Database records are hosted on Neon Postgres and Amazon DynamoDB with access controls and encryption.

While we take reasonable steps to protect your information, no system is completely secure. We cannot guarantee absolute security.

10. Data Retention & Deletion

Retention Periods

We retain your information for as long as your account is active or as needed to provide the Service. Specific retention periods are as follows:

• Meeting recordings and transcripts — Retained for the duration of your active account. Deleted within 30 days of account deletion or upon an earlier deletion request.
• AI-extracted signals and insights — Retained for the duration of your active account. Deleted within 30 days of account deletion or upon an earlier deletion request.
• Google user data (email content, Drive files, calendar data, contacts, documents) —HQ's Google tools do not store the content they return. If an agent's conversation is saved in your HQ session history, that history keeps what the agent read until you delete it, delete your account, or ask us to delete it, and is deleted within 30 days of that request. Google sign-in credentials are deleted when you disconnect Google (in Personal Integrations as well, if the company connection uses your personal Google connection). Redacted audit records of changes (actor, tool, time, resource ID, outcome) are part of our audit log, which we keep after an account is deleted (see Exceptions to Deletion below).
• Account information (name, email, profile, preferences) — Retained until you delete your account. Deleted within 30 days of account deletion.
• Payment and billing records — Retained for 7 years after the last transaction as required by applicable tax and financial regulations.
• Usage and technical data — Identifiable usage data is deleted within 30 days of account deletion. Aggregated or anonymized analytics data may be retained indefinitely as it cannot be linked back to you.

Deleting Your Account and Data

To delete your account and its data, email privacy@hqforwork.com from the email address on your account, with the subject line "Data Deletion Request." Account deletion is handled by our support team; there is no self-serve delete button in HQ settings yet. We will confirm the request and complete deletion within 30 days of receiving it, except where retention is required by law or regulation (see exceptions below).

When we delete an account:

• We delete your personal vault, meeting bot records, registered devices, session history, and your sign-in account, and remove you as the owner of any agents. If you run outposts, our support team deprovisions them first.
• You leave every company you belong to. A company where you are the only member and that has no pending invitations is deleted, and its data is purged 30 days later.
• Billing history and invoices, the audit log, and support tickets with their attachments are kept (see Exceptions to Deletion below).
• Copies held in our support and engineering tools (Slack, Linear, Sentry, and PostHog) are erased by our support team by hand as part of the request.

Before we can delete an account, any active subscription on your personal account, or on a company where you are the only member, must be cancelled, and a company with other members or pending invitations needs another owner. We will tell you if any of these applies.

Deleting Google Data Specifically

If you want to delete only the Google-sourced data that HQ has stored — without deleting your entire account — you can do so by following these steps:

1. Revoke access — Go to your Google Account permissions page and remove HQ from your authorized apps. This immediately stops HQ from accessing any new Google data.
2. Request deletion — Email privacy@hqforwork.com with the subject line "Google Data Deletion Request" and include the email address associated with your Google account.
3. What we delete — Within 30 days of your request, we will delete all Google-sourced data stored by HQ, including stored Google credentials, saved session history containing Google content, and any AI-extracted insights derived solely from Google-sourced content. Data an AI provider holds is deleted on that provider's schedule, generally within 30 days.

We will send you a confirmation email once the deletion is complete.

Exceptions to Deletion

Certain data may be retained beyond the 30-day deletion period where required or permitted by law. This includes:

• Payment and billing records, including invoices, required to be retained under tax, accounting, or financial regulations
• The audit log of account, admin, and security actions, including the redacted records of changes to Google data described in Section 6. We keep the audit log after an account is deleted.
• Support tickets and their attachments
• Data necessary to comply with a legal obligation, resolve disputes, or enforce our agreements
• Records required to be maintained for regulatory compliance or audit purposes
• Aggregated or anonymized data that can no longer be linked to you

11. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access — Request a copy of the personal information we hold about you
• Correction — Request correction of inaccurate or incomplete information
• Deletion — Request deletion of your personal information, subject to legal retention requirements
• Data Portability — Request your data in a structured, commonly used format
• Opt-Out of Analytics — You may opt out of product analytics tracking by contacting us
• Withdraw Consent — Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at the address provided below. We will respond within the timeframe required by applicable law.

12. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Categories of Personal Information Collected

• Identifiers (name, email address, account ID)
• Commercial information (subscription and payment history)
• Internet or electronic network activity (usage data, log data)
• Audio and electronic information (meeting recordings, transcripts)
• Professional or employment-related information (as referenced in meeting content, given in lead forms, or added by data enrichment providers)
• Inferences drawn from the above (AI-extracted signals and insights)

Your CCPA Rights

• Right to Know — You may request the categories and specific pieces of personal information we have collected about you
• Right to Delete — You may request deletion of your personal information
• Right to Opt-Out of Sale or Sharing — We do not sell personal information for money, but sharing identifiers and website activity with Meta for advertising may count as a "sale" or "sharing" under the CCPA. You can opt out with the "Do not sell or share my personal information" link or a Global Privacy Control signal, as described in Section 8
• Right to Non-Discrimination — We will not discriminate against you for exercising your rights

To submit a request, contact us using the information in Section 16 below.

13. International Users

If you are located outside the United States, please note that your information is transferred to and processed in the United States, where our servers and service providers are located. Some AI processing through Amazon Bedrock uses a global cross-region inference profile, so those requests can be processed in AWS regions outside the United States.

Legal Basis for Processing (EEA/UK)

• Performance of a contract — To provide the Service you have requested
• Legitimate interests — To operate, improve, and secure the Service
• Consent — Where you have provided explicit consent for specific processing activities

Data Transfers

We transfer data outside the EEA/UK using appropriate safeguards, including standard contractual clauses approved by the European Commission or equivalent mechanisms.

Additional Rights for EEA/UK Residents

• Right to restrict processing
• Right to object to processing based on legitimate interests
• Right to lodge a complaint with your local data protection authority

14. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will promptly delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a notice within the Service prior to the changes taking effect. The "Last Updated" date at the top of this policy indicates when it was most recently revised.

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at: