Privacy policy

1. Who we are

TeyeMatics Inc. ("TeyeMatics", "we", "us") runs the TeyeMatics Agentic Workforce. We design, build and run AI agent "departments" for organizations. Examples include support, finance operations, IT service desk and sales operations.

We serve businesses, not consumers. This policy explains what personal information we collect, why, who we share it with, how long we keep it, and the choices you have. It covers our website at teyematics.com, the registration process, the TeyeMatics web console, and our services, including the 30-day Observer.

2. Our role with client data

We play two different roles, depending on the information:

• Information about you that we collect directly. This includes website registration details and console account details. For this information, we decide how it is used.
• Client data. This is the business content our clients connect to the service or give us, such as emails, tickets, CRM records, finance records and files. We process client data on behalf of the client and under the client's instructions. The client decides what to connect and what agents may do with it.

If you are a client's customer, employee or contact and your information is in client data, the client is your first point of contact for privacy requests. We will help the client respond.

3. What we collect

3.1 When you register on our website

• Your name, company, work email and phone number.
• Your company size band and sector.
• The departments you are interested in, and a one-line goal.
• Bot checks. We use a CAPTCHA (Cloudflare Turnstile) and invisible checks. These include a hashed network identifier, which helps us spot repeat sign-ups. We store the hash, not the raw identifier.

You must confirm your email address. Our onboarding team then reviews each registration. We may call you to learn more. We approve or decline each registration and record a reason.

3.2 When you use the console

• Your name, email and role in your organization's workspace.
• Sign-in details. You can sign in with email and password plus a second step (a passkey or an authenticator app). Or you can use company sign-in through Google, Microsoft or Okta. With company sign-in, we receive your name, your email, and whether the provider applied multi-factor authentication.
• Activity in the console, such as the actions you approve, pause or stop. We keep an audit log of these actions.

Sign-in runs on Amazon Cognito. We do not see or store your company sign-in password.

3.3 Client data

Clients connect their own business tools, for example email, ticketing, CRM, finance and storage. Agents process the business content in those tools to do the work the client asked for. That content can include personal information about the client's customers, staff and contacts. What it includes depends on what the client connects.

3.4 The 30-day Observer (optional)

The Observer is an optional paid service. It reads a client's work through read-only connections the client grants. Its purpose is to map how work really happens before we build. More detail is in section 5.

3.5 When you contact us

If you email or call us, we keep what you send us and our reply so we can help you.

4. How we use information

We use the information above to:

• Review registrations and decide whether to approve them.
• Create and secure console accounts, including sign-in and multi-factor checks.
• Provide the service: run agents, show work for approval, and carry out the actions people approve.
• Send transactional emails (see section 9).
• Prevent fraud, abuse and bot sign-ups.
• Keep the service secure and keep a record of who did what.
• Meet legal obligations and enforce our terms.

We use client data only to provide the service to that client. We do not use client data to train AI models.

5. How agents handle client data

• People approve outward actions. Every email, post, message, payment or refund made through a built-in tool waits for a person at the client to approve it.
• Clients stay in control. A client can pause or stop any agent or any department at any time.
• Read-only by default. Connections to client tools are read-only unless the client chooses otherwise.
• Credentials are locked away. Credentials for connected tools are stored encrypted in the client's own workspace vault. The vault uses AWS Secrets Manager with a separate key for each workspace.
• Each workspace is walled off. Client data is separated per workspace at the database row level, so one client cannot see another client's data.

The 30-day Observer

• It reads only through the read-only connections the client grants.
• By default it runs in the TeyeMatics cloud.
• Work summaries leave the client only after the client approves them. They contain no personal or account details.
• We keep Observer data for 1 year after the engagement ends. We send a reminder at 6 months. If the client asks, we delete it within 30 days of the request.

6. AI model providers

Agents use AI models to read content and produce answers. To do that, the content is sent to the model provider, which processes it and returns a result. The providers we use today include Anthropic.

Under their terms, these providers do not train their models on content sent through their business APIs.

7. Who we share information with

We share information only with the service providers that help us run TeyeMatics (our subprocessors), with the client whose workspace it belongs to, and when the law requires it. Our subprocessors are:

We may also share information if the law requires it, to protect people or our rights, or as part of a merger, sale or similar change of ownership. If that happens, this policy will continue to apply to the information.

8. We do not sell personal data

We do not sell personal data. We do not share it for advertising across other sites. We do not use client data to train AI models.

9. Emails we send

We send transactional emails only. These are:

• Confirming your registration.
• Telling you your registration is under review.
• Telling you our decision.
• Sign-in codes.
• Notices to workspace owners when a connection to one of their tools fails.

We do not send marketing email unless you have agreed to receive it.

10. Cookies and browser storage

• Website. The website stores nothing in your browser beyond the CAPTCHA's own cookie, which Cloudflare Turnstile sets to tell people from bots.
• Console. The console stores sign-in tokens in your browser session so you stay signed in while you work.
• No advertising cookies. We do not use advertising or tracking cookies.
• Analytics. We do not use analytics tools at present.

11. How long we keep information

We may keep some information longer if the law requires it.

12. Deleting accounts and workspaces

Deleting your own account

• You can delete your own account from the console.
• There is a 30-day hold. You can cancel during that time.
• After 30 days, your sign-in and personal details are erased.
• Approvals you made in the past stay in the workspace's activity record, shown as "Former member".

Deleting a workspace

• A workspace owner can delete the whole workspace.
• There is a 30-day hold. During the hold, everything in the workspace is paused. The owner can cancel at any time.
• After 30 days, everything in the workspace is erased.
• Backups age out in up to 7 days after that.
• Stored secrets and encryption keys are scheduled for deletion. AWS requires a minimum of 7 days before a key is deleted.

When support starts a deletion

TeyeMatics support can start either kind of deletion only when someone at the client asks. The client can still cancel during the hold.

13. Security

• Data is encrypted in transit and at rest.
• Each workspace has its own encryption key.
• We keep an audit log of actions.
• Access follows least privilege: people and systems get only the access they need.
• TeyeMatics operators see only the clients they are assigned to.
• Console sign-in requires a second step, or company sign-in through the client's own provider.

No system is perfectly secure. If we learn of a breach that affects your information, we will notify you and the client as the law requires.

14. Where data is stored

We store and process data in the United States.

15. Your choices and rights

Depending on where you live, you may have the right to:

• Ask what personal information we hold about you.
• Ask us to correct it.
• Ask us to delete it.
• Ask for a copy of it.
• Object to or limit some uses of it.

To make a request, contact us using the details in section 18. We will confirm who you are before acting on a request. We will not treat you differently for using these rights.

If your information is part of a client's data, we will pass your request to that client, because the client controls that data. We will help the client respond.

16. Children

TeyeMatics is for businesses. It is not meant for anyone under 18, and we do not knowingly collect information from children. If you think a child has given us information, contact us and we will delete it.

17. Changes to this policy

We may update this policy. If we make an important change, we will tell clients by email or in the console before it takes effect. The "last updated" date at the top shows when this policy last changed.

18. Contact us

Our terms of service cover use of the service.