Privacy policy.

Feltlab is run by Feltlab Software Pty Ltd, an Australian company based in Brisbane. This policy covers the feltlab.dev website and the agents we set up and run for our clients. We handle personal information with the Australian Privacy Principles as our guide. Questions and requests go to jason@feltlab.dev.

What we collect on this site

• Booking a call: your name, email address, business and anything you write in the booking form, used to hold the time in our calendar and send you the meeting link.
• Signing up: your business name, contact details, ABN and industry, and the card you pay with. Payment is taken by Stripe; we never see your full card details. Stripe’s own privacy policy applies to what it holds.
• Your account page: the email address a sign-in link is sent to. There are no passwords.
• Site analytics: we use Google Analytics to see which pages are read. It sets cookies and reports visits to Google in aggregate. We don’t use it to identify you.

What the agent can see

When you become a client, your agent runs on a server set up for your business alone. It works inside the tools your staff connect to it (your website, CRM, inbox, accounting and so on), and it can only see what those tools let it see:

• You choose what to connect. Each tool is connected by someone at your business signing in to that tool and approving the exact access the agent is asking for. The approval screen lists it. Nothing is connected on your behalf.
• Read-only first. New connections start read-only wherever the tool allows it. Anything that sends, changes or spends waits for a yes from you or your team in Slack.
• Mailboxes are personal. Email access is connected one mailbox at a time, by the person whose mailbox it is. The agent answers that person about their own mail and does not summarise one person’s mailbox for another.
• You can revoke it at any time, from inside the tool (the connected apps or third-party access page of your Google Workspace, Microsoft 365, HubSpot or other account), by asking us, or by cancelling.

How connections are kept

When someone connects a tool, the tool issues Feltlab a token in place of a password. We store those tokens encrypted on our servers in Sydney, Australia. Your agent’s server fetches a short-lived token from us when it needs one and never holds the long-lived one. We never ask for, store or see your passwords. Disconnecting a tool deletes its token, and revokes it at the tool where the tool allows that.

How AI is used

Your agent uses AI models to read requests and write replies. When a step needs AI, only the information for that step is sent to the model, not your whole mailbox or database. We only use AI providers that don’t train on the data they’re sent or keep it after the request, and we block the ones that would. Each client has their own AI keys with spending limits, so usage is separate and visible. Your information is never used to train AI models, by us or anyone else.

Google user data

If someone at your business connects their Google Workspace mailbox, the agent uses the Gmail API to read mail on their behalf. Feltlab’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Gmail data is used only to answer that person’s own requests to their agent, such as finding an email or summarising a thread.
• It is not used for advertising, sold, or used to train AI models.
• No human at Feltlab reads it, except where that person has asked us to help with a specific problem, where it’s needed for security or to comply with the law.
• It is only transferred to the AI providers described above, for the step that needs it, and to no one else.
• Access ends the moment the mailbox is disconnected, and its token is revoked at Google.

The same applies to mailboxes connected through Microsoft 365.

What we keep and for how long

• Booking and sign-up details: for as long as you’re a client or a prospect, and as our tax and company records require.
• Connection tokens: until the tool is disconnected or you cancel.
• The agent’s action log, a plain-English record of what it read, wrote and sent: kept so you can check what happened, and deleted with your server when you cancel.
• Slack messages: held by Slack in your business’s own workspace, under Slack’s terms.

Who else sees it

The services we rely on to run Feltlab, each with its own privacy policy: Stripe for payment, Slack for the channel, Google and Zoom for bookings, Resend for sign-in emails, Vercel for this website, DigitalOcean and Upstash for servers and storage, and the AI providers described above through OpenRouter. We don’t sell personal information, and we don’t share it with anyone for their own marketing.

Your choices

You can ask us what we hold about you or your business, ask us to correct or delete it, or disconnect any tool at any time. Email jason@feltlab.dev. If you’re not happy with how we’ve handled something, tell us first; you can also raise it with the Office of the Australian Information Commissioner.

Changes

If this policy changes in a way that matters, we’ll tell clients in their Slack channel and update the date at the top.